Your school holds more sensitive information about children than most businesses hold about anyone. Addresses, dates of birth, family circumstances, allergies and medical notes, safeguarding records, photographs, attendance, grades, who may collect whom at the gate, and who is behind on their fees.
Student data protection in schools is usually discussed as a policy document somebody signed once. Almost nothing leaks through a policy document. It leaks through a photo of the register in a staff WhatsApp group, a spreadsheet forwarded to a personal email address, a login three people share because it was easier that way.
This post covers the operational side: where your data has spread to, who should see what, what to do when a member of staff leaves, and what to ask a software vendor. It is not legal advice, and it states nothing about what any regulation requires — that belongs to your national data protection authority and your own legal adviser.
The data you hold, and the copies you have lost track of
List the categories of information your centre holds about a single student. Most schools reach fifteen or twenty: identity and contact details, guardian and emergency contacts, medical and dietary notes, learning support records, attendance, assessment results, disciplinary notes, photographs, payment history, and — in language academies — passport and visa documents collected at enrolment.
Now the harder half: for each category, write down where it actually lives — not where it is supposed to.
A realistic answer for a mid-sized academy: the main system, plus a spreadsheet the Director of Studies keeps because the system does not produce the one report she needs, plus a monthly export to the accountant, plus attachments in a shared inbox nobody has cleared out, plus registers printed for a fire drill, plus a folder on a teacher's laptop, plus a WhatsApp group.
That list is your real exposure. The policy on the shared drive covers the first item. Everything after it is the part that goes wrong.
Most leaks are habits, not attacks
Nobody targeted your academy. Somebody was in a hurry.
The photo of the register
A teacher photographs the paper register and posts it in the staff WhatsApp group so the cover teacher has it before nine o'clock. It works, which is why it keeps happening. It also puts children's names on every phone in that group, in those phones' cloud backups, and in the group history of whoever joins next year.
The spreadsheet nobody meant to send
Someone exports the student list with medical notes and emails it to their own address to finish at home, on a laptop the school does not control. Or autocomplete picks a similar name and it goes to the wrong contact entirely. No attacker required.
The shared login
One account for reception, because setting up four was a nuisance. Now nobody can tell who changed a grade, who downloaded a family's payment history, or who was logged in when a record disappeared. Shared logins do not only weaken access control — they remove the audit trail.
The account that still works
A teacher left in June. In November their email still receives mail, their platform account still opens, their shared drive access is intact. Removing access is nobody's job until it is written down as somebody's job.
The parent who sees the wrong family
A statement emailed to the wrong guardian, a class list attached where an individual report was meant, a portal that shows more than it should. Family financial information is student data too, and it is the leak parents notice fastest.
Reports living on laptops
Exports become permanent. A report pulled in September is still on three devices in June, long after the live system corrected the record behind it — a privacy risk and an accuracy problem at once.
Start by collecting less
The cheapest data to protect is the data you never collected.
Go through your enrolment form field by field with one question: what operational decision do we make with this? If nobody can name one, the field is there because it was on the previous form. A parent's occupation, a second phone number nobody has dialled, a copy of a document you needed to check but not keep — each is a small permanent liability for nothing.
The same applies to free-text boxes. "Notes" fields fill with observations about families that would be uncomfortable to read aloud if that family asked to see their file. Give sensitive information a structured home with restricted access instead of a field everyone can read.
Decide who sees what — by role, not by trust
Most schools operate on trust, which is not a control. Trust says "everyone here is decent". A control says "the finance assistant cannot open safeguarding notes, and nobody has to rely on her choosing not to".
Write your roles down — reception, admissions, teacher, Director of Studies, finance, management — and decide what each needs to do its job. A teacher needs their groups, attendance and grades; they rarely need a family's payment history. Finance needs balances and invoices; it rarely needs medical notes. Management needs aggregate reporting, which is not the same as every individual record.
Two rules make this workable in a small centre. Permissions belong to the role, not the person, so a new hire inherits the right access on day one. And when someone genuinely needs an exception, grant it and record why — an exception you can see is manageable, one that quietly became the default is not.
This is where a real system earns its keep. If your student records and attendance live in one place with per-role permissions, staff stop making private copies to get their work done — and private copies are the whole problem.
The leavers process most schools don't have
Write a checklist and attach it to the last day of employment, the same way you do with keys.
Disable the platform account rather than deleting it, so the history of who did what stays attached to a real person. Retire or redirect the email account. Remove them from WhatsApp groups, shared drives and the shared inbox. Ask what is on their personal device and get it deleted. Reassign ownership of any document or report they created.
Run the same checklist when a role changes internally: a teacher moving into admissions should gain admissions access and lose what they no longer need. Access that only ever accumulates is how a fifteen-year veteran ends up able to see everything in the building.
Photos and consent
Photographs of children are where schools most often act on assumption. A consent signed at enrolment for "school use" is doing a great deal of work if it is stretched to cover a public social media account, an advertising campaign and a photo library kept indefinitely.
Three things help. Record consent per purpose rather than as a single yes, so "yearbook" and "public Instagram" are separate answers. Make the answer visible to the people who take and publish photos — a consent form in a cabinet the marketing coordinator never opens is not a control. And make withdrawal easy: a family should be able to change their mind, and someone's job should be to act on it.
What consent you need, and in what form, depends on the regime you sit under — the GDPR in Europe, something different elsewhere. Check with your data protection authority or your legal adviser. Ireland's Data Protection Commission, for instance, publishes a data protection toolkit aimed specifically at schools.
Questions to ask a software vendor
You are handing a company a database of minors. A vendor who cannot answer these plainly has told you something.
Where is the data physically stored? Which country, which provider — in writing, not on a sales call.
Who inside your company can see our data, and when? Support access is normal. Unlogged, unrestricted support access is not.
What does the permission model let us do? Ask for a demonstration with a restricted account, not a slide. Can you stop a teacher seeing balances, or reception opening medical notes?
Is there an audit trail? Who viewed or changed a record, and how far back?
What happens when a user leaves? How fast can access be revoked, and does the history survive it?
How do we get our data back out? In what format, how completely, how quickly. A platform you cannot export from is a platform you cannot leave.
What happens at the end of the contract? What is deleted, when, and how it is confirmed.
What documentation will you sign? Ask which contractual and compliance documents they provide, then have your adviser read them.
Ask the export question early. It separates vendors who expect to keep you by being good from vendors who expect to keep you by being difficult to leave.
What this looks like with a proper system
Consolidating is not about software being inherently safer than a spreadsheet. One system with real roles removes the reasons people make copies.
When admissions, academic records and finance are one record, nobody re-types a student into a third sheet and nobody emails themselves an export. When enrolment documents are stored against the student instead of living in an inbox, the passport scan stops circulating as an attachment. When families see their own balances and account statements in a portal, staff stop composing individual emails that can go to the wrong address.
KMPUS is built with customisable permissions and protection of institution and student data, so what a teacher, a receptionist and an accounts manager can open are three different things. That matters most in a growing centre: NED College runs in Dublin and Limerick with around 1,500 students, where "who at which campus can see what" is not theoretical.
None of this replaces a decision. The software enforces the rules you set. It does not choose them for you.
Frequently asked questions
Does a small academy really need to worry about this?
Size changes the scale of a mistake, not whether one happens. A centre with 120 students still holds medical notes, family contacts and payment histories, and still has a staff WhatsApp group. The consolation: it can be done properly in an afternoon — list the data, list the roles, close the old accounts.
Can staff use WhatsApp to talk about students?
Treat it as a scheduling channel, not a records channel. The line most schools land on: nothing identifying a student — no register photos, no screenshots, no medical or behavioural detail — goes into a group chat. Anything that needs saying about a specific child gets said in the system, where access is controlled and logged.
How long should we keep student records?
There is no single answer, and this post is not the place to invent one: expectations differ by country, by sector and by type of record. The operational half is universal — decide deliberately, write the decision down, apply it, instead of keeping everything forever by default. Confirm the periods with your data protection authority or your legal adviser.
A family has asked to see everything we hold on their child. What do we do?
The request is never the hard part. Not knowing where all the copies are is, which is why the inventory in the first section matters. Have one named person who owns these requests, a documented process for gathering material from every system it touches, and legal advice on how such a request must be handled where you are.
Is cloud software riskier than keeping data in our own office?
Different risks, not obviously ordered ones. A filing cabinet has no two-factor authentication and no audit trail. What matters is whether you can answer the vendor questions above — and whether your staff habits are contained either way.
Want to see what role-based access looks like on your own data? Start a free trial of KMPUS and set your roles before you migrate a single student.
