MIT had the same problem in late 2003, and in the case of the college applications, solved the problem by simply destroying parts of the records when they were done with them.
Which is how it should be. I can understand keeping a summary of the data to track the performance of your admissions process, but you shouldn't be keeping highly personal information about students for any longer than it takes to make the admissions decision.
(http://tech.mit.edu/V123/N53/53studrec.53n.html and http://tech.mit.edu/V124/N47/47e3.47n.html)