Retention of dismissed allegation on student record

Short answer

Yes, in principle a university in England and Wales can keep a record that an allegation was made against you even where it was withdrawn, dismissed or not proven. There is no automatic legal right to have every trace of an unproven allegation deleted. However, any retention must comply with UK data protection law, and you have real and enforceable rights: the record must be accurate, it must clearly reflect the outcome, and it can only be kept for a lawful purpose, in a proportionate way, and for no longer than necessary. If those conditions are not met you can challenge the retention.

The legal framework

Your student record is personal data, so its handling is governed by the UK GDPR and the Data Protection Act 2018. The most relevant data protection principles are:

Lawfulness, fairness and transparency. The university needs a lawful basis to hold the information (usually its legitimate interests or the performance of a task carried out in the public interest) and must have told you, normally in its privacy notice, what it holds and why.

Purpose limitation and data minimisation. It can only keep the information for a specific, justified purpose and should not hold more than it needs for that purpose.

Accuracy. This is often the strongest point in your favour. If a record simply notes an allegation without recording that it was withdrawn, dismissed or found not proven, it is arguably inaccurate or misleading. You are entitled to have it corrected so that the outcome is stated clearly.

Storage limitation. Data must not be kept longer than necessary. Universities set this out in a retention schedule. Records of misconduct investigations are commonly kept for a limited period after your relationship with the university ends, often up to around six years, reflecting the Limitation Act 1980, but the schedule must be justified and applied consistently.

Why a university may legitimately keep it

Before assuming retention is unlawful, it is worth recognising there are ordinary and legitimate reasons a university keeps such records:

To demonstrate that it followed a fair process, in case you or someone else later challenges the decision or complains.

To defend itself against potential legal claims within the limitation period.

For safeguarding purposes, to identify patterns where multiple separate reports are made about the same person, even where no single one proceeded. This is a recognised purpose in sector guidance on handling misconduct complaints.

Because “withdrawn” or “dismissed” is not the same as “false”. An allegation dropped for lack of evidence, or because a complainant did not wish to proceed, is different from one positively found to be untrue. The university may reasonably keep a factual, neutral record of what happened.

The existence of a legitimate purpose does not give the university a free hand, but it does mean the mere fact of retention is not automatically unlawful.

Your rights and how to use them

Right of access. Make a subject access request to obtain a copy of exactly what is held about the allegation, where it is held, who can see it and how long it will be kept. You cannot sensibly challenge a record until you know its contents. The university must normally respond within one month and free of charge.

Right to rectification. If the record is inaccurate, incomplete or misleading, ask for it to be corrected. Even if the underlying record stays, you can insist that it clearly and prominently records that the allegation was withdrawn, dismissed or not upheld, and, where appropriate, that no finding of wrongdoing was made against you. This is often the most realistic and valuable outcome.

Right to erasure. You can ask for the data to be deleted, but this right is qualified, not absolute. The university can refuse if it still has a lawful basis and a genuine ongoing need to keep the information, for example to defend potential claims or for safeguarding. If it cannot show such a need, or the retention period has expired, erasure should follow.

Right to object and right to restriction. You can object to processing based on legitimate interests, requiring the university to demonstrate compelling grounds that override your interests. You can also ask it to restrict processing, for example while a dispute about accuracy is resolved.

What matters most in your situation

The right answer depends on facts you have not yet given, and different scenarios lead to different outcomes:

The precise outcome. There is a real difference between an allegation that was formally investigated and dismissed on the merits, one withdrawn by a complainant, and one found to be malicious or fabricated. The stronger the finding in your favour, the stronger your case that the record should be neutralised, closed or deleted.

What the record actually says. If it records only the accusation, that is a much stronger accuracy complaint than if it already notes the exculpatory outcome.

Who can see it and how it is used. A closed internal note kept only for defensive and audit purposes is very different from something disclosed in references, to placement providers, professional regulators, or to other institutions. Disclosure of an unproven allegation to third parties is far harder to justify and is where fairness challenges most often succeed.

Whether it engages fitness to practise. On regulated courses such as medicine, nursing, social work or teaching, retention and disclosure standards differ and safeguarding considerations weigh more heavily.

Practical steps

1. Make a subject access request in writing so you know precisely what is held, its stated purpose and its retention period.

2. Check the university’s own privacy notice, records retention schedule and the relevant student conduct or complaints procedure. The university is bound by its own published policies, and departing from them without justification is itself challengeable.

3. Write a clear, calm letter to the relevant office. Ask, in order: that the record accurately state the outcome; that access to it be restricted to those with a genuine need; that it not be disclosed in references or to third parties without your consent; and that it be deleted once no lawful purpose remains or the retention period ends. Ask specifically what lawful basis and retention period they rely on.

4. If you are unhappy with the response, use the university’s internal complaints procedure and obtain a Completion of Procedures letter.

5. Escalate externally. For data protection failures, such as inaccuracy, excessive retention or unjustified refusal to erase, you can complain to the Information Commissioner’s Office. For unfairness in how the university handled the matter and its records, you can complain to the Office of the Independent Adjudicator for Higher Education once internal procedures are complete. These routes are cheaper, faster and lower risk than litigation, though a data protection claim in court for damage or distress remains available in a serious case.

Bottom line

Retention of a record about a withdrawn, dismissed or unproven allegation is not, by itself, unlawful. What the law requires is that the record be accurate, that it clearly reflect the outcome, that it be kept only for a genuine purpose and only for as long as necessary, and that it not be disclosed inappropriately. The most achievable and often most valuable result is usually not total deletion but correction and restriction: ensuring the record plainly shows the allegation was not upheld, limiting who can see it, and preventing it being used against you in references or disclosures. Seek the exact contents first, then press the accuracy and proportionality points, and escalate to the ICO or the OIA if the university does not respond properly.