How long should Zoom recording be kept?

This is a very good question, to which I do not know of a definitive answer. I’m not a lawyer, but here’s my thinking.

These recordings constitute personal data because they contain personal images of identifiable people. This means that under GDPR, keeping these recording should be considered by your Data Protection Officer as part of the Data Protection Impact Assessment (DPIA). Briefly this means assessing what data is being captured, why it is held, who can access it and for what reason, and how long it is kept. Data should only be retained for as long as is necessary to meet the needs of the reason for recording it.

The Data protection: a toolkit for schools (DfE, 2018) is perhaps the best document to consult here. On page 75, the guidance suggests four ‘tiers’ of retention:

Short term – date of first recording plus 1 month
Medium Term – 1 year
Long Term – 5 years
Very long term – until pupil is 25 years of age or older

As I see it, the recording of Zoom calls is to investigate any complaints that might arise or for crime prevention and investigation. It is probably unjustifiable to keep the recordings for the long or very long term, and a month might be too short.You should check with your Data Protection Officer or legal provider, but for me I would think 6 - 12 months would be about the right ballpark