Q. How long are Canvas user records and courses kept for?

A. Historic users and courses need to be deleted for two reasons: to comply with the legal (GDPR) requirements regarding retention and storage of personal data (staff and students); and to minimise the storage costs of long-term data. Users and courses will be automatically deleted from Canvas according to the specifications described below.

User deletion (staff and students)

SSO users will be deleted from Canvas as follows:

11 months after the user’s SSO has expired, the user is soft deleted, meaning the user’s data will not be visible to anyone any more, but can be recovered if needed (e.g. as evidence to justify a University decision)
5 years after the soft deletion the user record is hard deleted (i.e. no longer recoverable).
As of November 2020 the 11 months has been temporarily extended to 23 months to accommodate users impacted by the Covid-19 pandemic

Non-SSO (external) user accounts will be automatically deleted after 13 months of inactivity.

Course deletion

All Canvas courses with a Term end date (or a different specified End Date) will be automatically soft deleted 11 years thereafter.
One year after the soft deletion, the course deletion will be made permanent.

Important:

It is your responsibility to ensure that you do not post personal or sensitive information in a Canvas course that you would be hesitant to have available for extended periods.
Even once your enrolment on a Canvas course has expired, your discussion comments will remain there anonymously. You should therefore avoid posting any information (particularly identifiable personal data) that you would not be happy to have remain on the course in its archived version.
SSO of a visiting student will be deleted from Canvas once they leave Oxford, as they are not doing Award bearing programme. Hence, their Canvas accounts will not be retained for the above mentioned 23 month time period.