Privacy review guide for timetables and attendance

1. Define purpose and records

List each purpose: timetable construction, room allocation, cover, attendance capture, follow-up, reporting, family communication, safeguarding escalation, integration, support, or audit.

For each purpose, identify data fields, people, source, authoritative record, decision, retention need, access boundary, correction route, sharing, supplier role, and evidence. Avoid collecting a field because a screen happens to offer it.

2. Minimise and separate

Separate academic timetable information, attendance status, reason, family contact, safeguarding information, support notes, finance data, and technical logs where their purposes, access, retention, or sensitivity differ.

Test absent teacher, substitute, room change, cancelled period, changed class, late arrival, partial attendance, transfer, duplicate mark, closure, report, export, and support cases for unnecessary disclosure.

3. Review access and sharing

Map view, create, edit, review, approve, publish, export, correct, archive, and delete by role, campus, class, student, family, supplier, integration, support user, and temporary assignment.

The U.S. Department of Education data governance checklist covers quality, access, security, lifecycle, sharing, disposal, and monitoring. Check access removal, shared devices, links, downloads, notifications, and cross-campus boundaries.

4. Review lifecycle and correction

Document collection, validation, use, correction, report, export, archive, retention, disposal, backup, restoration, incident, and subject or family query routes according to approved local policy.

GOV.UK school guidance emphasises accountable and secure handling. Use qualified local privacy, safeguarding, records, security, accessibility, and legal advice rather than treating a vendor statement as a complete review.

5. Review supplier and integration risk

Ask what suppliers and integrations receive, why, where, for how long, under whose instruction, with what controls, logs, retries, failure handling, support access, deletion, return, and subcontractor visibility.

Record unresolved questions, evidence requests, contract controls, incident contacts, access review frequency, and who approves a new field, integration, campus, or reporting use.

6. Test user-facing privacy

Review invitations, identity matching, family access, notifications, exports, search, reports, correction messages, accessibility, language, shared custody or authorised contacts where applicable, and support tickets.

A person should receive enough information to understand and correct a timetable or attendance issue without exposing another person’s record or placing sensitive details in an uncontrolled channel.

7. Record the decision

Write purpose, fields, roles, sharing, lifecycle, evidence, limitation, risk, owner, approval, review date, and change trigger. Keep product capability, school responsibility, professional judgement, and legal advice distinct.

At 30, 60, and 90 days, review access exceptions, exports, corrections, support demand, incidents, retention actions, report confidence, and the original purpose. Expand, repair, narrow, consolidate, or hold on evidence.

Turn the guidance into an accountable decision

Apply this guidance to one bounded part of privacy review guide for school timetable and attendance software. Define the scheduling or attendance decision, authoritative record, accountable owner, permitted users, correction route, evidence, and review date.

Test an ordinary case and meaningful exceptions such as an absent teacher, substitute, room change, cancelled period, changed class, late arrival, early departure, partial attendance, transfer, duplicate mark, closure, outage, or reporting-period change.

Keep supplier capability, school responsibility, professional judgement, legal advice, and measured outcome separate. If evidence is incomplete, narrow the claim and pilot the smallest safe change.

Review at 30, 60, and 90 days. Check completeness, timeliness, consistency, corrections, access exceptions, staff effort, support demand, reporting confidence, and the original outcome. Decide whether to expand, repair, consolidate, narrow, or hold.

Before approval, ask a reviewer who was not involved in the design to challenge the strongest assumption. Replace broad language with the exact evidence, population, date, and limitation the school can verify.

Document what was tested and what was not. A successful demonstration with a simple timetable does not establish readiness for substitutions, absences, split attendance, late marks, new periods, multiple campuses, or a changed academic calendar.

Keep evidence beside the decision record so a later reviewer can distinguish observed behaviour from an assumption, estimate, or supplier statement. Name the next test where evidence remains incomplete.

Revisit the boundary when the school adds a campus, year group, role, integration, reporting period, or policy. A small change can alter permissions, definitions, timing, retention, or support demand.

Set the next review date and owner. A dependable timetable and attendance operation is maintained through clear definitions, controlled change, professional judgement, and visible accountability rather than a one-time setup.

Make the handoff readable to a teacher, attendance officer, leader, and reviewer. State what passed, what remains manual, which records are authoritative, who owns unresolved conflicts, and how corrections are communicated without creating an uncontrolled copy.

Keep approved definitions beside validation rules, training notes, support routes, and change history. New rooms, periods, roles, integrations, or calendars can change the risk even when field names stay the same.