Privacy review guide for school management, ERP, and SIS

Start with the purpose and data

A privacy review should begin with the school decision and the minimum data needed to support it. Inventory student, guardian, staff, academic, attendance, assessment, fee, payment, document, communication, support, export, and backup data only where the proposed workflow requires it.

For each field, record purpose, source, owner, users, access, sharing, retention trigger, correction route, and deletion or return responsibility. Avoid collecting a field because a system can store it.

Review roles and relationships

Test staff roles, families, separated guardians, siblings, campuses, support users, suppliers, and administrators. Define who may view, create, edit, approve, publish, export, or administer each relevant record.

Ask how identity is verified, how access is removed, how privileged access is reviewed, and how the school handles a correction or a request from a person whose relationship has changed.

• Purpose and minimum necessary fields
• Role and relationship access
• Approval, publishing, and export controls
• Supplier and subprocessor responsibilities
• Retention, incident, correction, and deletion route

Follow data beyond the main screen

Map data moving to payment providers, communication services, identity services, integrations, support tools, backups, exports, and subprocessors. Ask what fields move, why, under whose instruction, where they are stored, and how a correction or deletion is evidenced.

GOV.UK procurement guidance recommends data protection by design and default, minimum necessary data, access control, security, subprocessors, breach notification, and data return or deletion. The school’s qualified privacy and legal advisers must apply local requirements.

Review quality, retention, and incidents

The U.S. Department of Education data governance checklist connects quality, access, security, lifecycle, sharing, disposal, and monitoring. Data-quality guidance emphasizes business rules, validation, infrastructure, and professional learning. Privacy depends on correct data and controlled lifecycle, not only on a notice.

Ask who detects an incident, contains access, notifies the school, supports continuity, records the event, and confirms recovery. Test backup, restore, export, correction, and reconciliation with controlled data.

Explain the family-facing result

Families need understandable information about what they can see, why it is shown, how to request correction, and where help is available. Do not promise complete visibility, instant updates, or permanent deletion without verifying the workflow and lifecycle.

Keep privacy review beside implementation, training, support, and change management. Staff and families experience privacy through daily permissions, messages, forms, documents, and responses to mistakes.

Approve a bounded privacy decision

Record the data set, purpose, roles, controls, suppliers, retention rule, residual risks, evidence, owner, and review date. Hold or narrow the phase when a critical purpose, access, sharing, incident, retention, or deletion question remains unresolved.

Apply the guidance to one school decision

Before approving this guidance for privacy review guide for school management software, translate it into one school-specific decision record. State the workflow, roles, data fields, permissions, evidence, support route, academic-calendar constraint, and condition that would hold the next phase.

Run the decision with controlled data and the people who will operate the workflow. Record what was observed, what remains unknown, who owns the unresolved item, and when it will be reviewed. Revisit the record after launch at 30, 60, and 90 days. Keep the record beside the acceptance tests, support guidance, and change log so later reviewers can see why the school proceeded, narrowed scope, or held the next phase.

If the evidence is incomplete, narrow the claim and the release. Explain what the school can verify today, what needs supplier or legal review, and what a reviewer should not infer from a demonstration or policy statement. This keeps the article useful without turning an unresolved question into a product promise.

Ask the accountable owner to confirm the next action in plain language and to identify the people who must be informed. A quality gate is complete only when the operators can perform the approved workflow, understand the exception route, and know how to report a problem without creating an uncontrolled copy of the record.

Keep the review proportionate to the risk. A small workflow may need a clear role test and data sample; a sensitive or cross-campus workflow may also need supplier documentation, incident handling, recovery, retention, and local legal review. Record the distinction so future readers understand why the gate is sufficient or still open.