Privacy review guide for exams, gradebooks, and report cards

Define the privacy decision

A privacy review should answer a bounded question: what assessment information is collected, for what purpose, from whom, by which roles, for how long, and with whom may it be shared? Start with the school’s actual workflow rather than the supplier’s feature list.

Inventory learner identity, assessment evidence, marks, grades, feedback, moderation, reports, family views, exports, integrations, support records, audit history, backups, and temporary files. Separate required data from optional convenience fields and document the owner of each purpose.

Map access and sharing

Describe access by learner, family where applicable, teacher, department, administrator, registrar, leader, bursar, IT, support, supplier, and external authority. Check whether permissions follow role, subject, cohort, campus, temporary assignment, or an outdated account.

Test publication, correction, exports, notifications, shared devices, links, support tickets, backups, analytics, and integrations. A report sent to the right family can still be a privacy failure if identity matching or access removal is unreliable.

Check lifecycle and rights

Record collection, use, review, correction, retention, archive, disposal, access removal, incident response, and exit. Identify the authoritative record and how a correction flows to reports, exports, integrations, backups, and family views.

The U.S. Department of Education data governance checklist covers quality, access, security, lifecycle, sharing, disposal, and monitoring. GOV.UK guidance is a useful public reference, but obtain qualified local privacy and legal advice for the school’s jurisdiction.

Evidence and approval

Keep the data map, purposes, access matrix, retention rule, supplier terms, security evidence, accessibility considerations, safeguarding review, incident route, and unresolved limitation with the decision.

Test ordinary and exceptional assessments, then ask an independent reviewer to challenge necessity, proportionality, accuracy, access, retention, sharing, correction, and exit assumptions. Review at 30, 60, and 90 days after material change.

Turn the guidance into an assessment decision

Apply this guidance to one bounded part of privacy review guide for school exam and gradebook software. Define the authoritative assessment or reporting record, accountable owner, permitted users, correction route, evidence, and review date.

Test an ordinary case and meaningful exceptions such as missing work, late work, absence, moderation, amended result, withdrawal, duplicate, report correction, access failure, or outage.

Keep supplier capability, school responsibility, professional judgement, local policy, legal advice, and measured outcome separate. If evidence is incomplete, narrow the claim and pilot the smallest safe change.

Review at 30, 60, and 90 days. Check completeness, timeliness, consistency, moderation, corrections, access exceptions, staff effort, support demand, reporting confidence, and the original outcome.

Before approval, ask a reviewer who was not involved in the design to challenge the strongest assumption. Record what was tested, what remains manual, and the next test where evidence is incomplete.

Revisit the boundary when the school adds a subject, year group, campus, grading scale, role, integration, reporting period, or policy. A small change can alter permissions, definitions, calculations, timing, retention, or support demand.

Keep approved definitions beside calculations, training, support routes, change history, and evidence. Set the next review date and owner so the operation is maintained rather than treated as a one-time setup.

Make the handoff readable to a teacher, administrator, leader, learner, family, and reviewer. State which record passed validation, which part remains manual, who owns an unresolved conflict, and how a correction is communicated.

Retain the sample, environment, date, version, calculation rule, permission, limitation, and reviewer alongside the decision. This allows a later team to reproduce the test instead of relying on a confident summary.

If the guidance depends on local assessment policy, privacy law, safeguarding practice, accessibility requirements, records rules, or contractual terms, name that dependency and obtain the appropriate qualified review before approval.

Do not use a successful demo, low support volume, or high report-view count as proof of quality by itself. Pair activity with observed accuracy, completeness, safe access, correction, staff effort, and the original reader or school outcome.

Record the smallest safe next change, its owner, acceptance evidence, rollback, and review date. A controlled decision is more valuable than a broad recommendation that cannot be tested or maintained.