Collecting Sensitive Data

When students register in an exam, you may need to collect sensitive identification documents such as passport scans, government-issued IDs, or other personal data. To help protect this information and reduce long-term liability, you can use a Custom Field with a Data Retention period. Files and data captured through the field will be automatically deleted once the retention period has elapsed.

How It Works

• Create a Custom Field for the sensitive data you need to collect (e.g. passport, photo ID).
• Set a data retention period, the number of days the value should be kept after it was last updated.
• In the exam registration options tab, select the custom fields you created so students can fill them out on the exam order page.
• Once the retention period elapses, the file or value is automatically deleted from the contact's record.

Step 1 - Create the Custom Field

1. Go to Contacts > Custom Fields.
2. Click New Field and choose the appropriate field type (e.g. File Upload for ID scans, or Text for an ID number).
3. Give the field a clear label, such as "Passport Scan" or "Photo ID".
4. Under Data Retention, select how long the value should be kept after it was last set. Available options include:
   • Keep Forever
   • 7 days
   • 14 days
   • 30 days
   • 60 days
   • 90 days
   • 6 months
   • 1 year
5. Save the field.

Tip: The retention period is measured from the last time the field value was set. If a value is updated, the countdown restarts.

Step 2 - Add the Field to an Exam

1. Go to Exams and open the exam you want to configure.
2. Open the Registration Options tab.
3. Select the custom field you created so it is requested from each student during enrolment.
4. Save the exam.

Students registering in the exam will now be shown the field and are will be able to provide the sensitive data as part of registration. The information is stored against the student's contact record.

Step 3 - Automatic Deletion

Once the retention period you configured has passed, the field's value, including any uploaded files, is automatically deleted from the contact's record. No manual cleanup is required.

This makes it safe to collect sensitive documents only for as long as you need them (for example, to verify identity at the time of the exam), without retaining personal data indefinitely.

Best Practices

• Only collect what you actually need — pick the shortest retention period that meets your operational and compliance requirements.
• Communicate your retention policy to students so they understand how long their data will be stored.
• Review your custom fields periodically to ensure each sensitive field has an appropriate retention period set.