Introduction
Parents and school representatives have the right to understand how student data is handled. This guide offers clear, practical questions to ask school leaders or platform providers, plus guidance on what to expect and how to follow up.
Why ask questions
- Transparency: know what data is collected and why.
- Control: understand who can access the data and how long it is stored.
- Security: verify which protections are in place for sensitive information.
Practical questions to ask (recommended order)
- What data do you collect and why?
- What categories of student data are collected (personal details, grades, photos, health data, etc.)?
- For which purposes are these data used (education, communication, administrative duties)?
What to expect: a clear list of data categories and documented purposes.
- What is the legal basis for processing?
- Is processing based on consent, legal obligations, or another basis? How is parental consent managed, and how can it be revoked?
What to expect: information on how consent is collected and managed.
- Who can access the data?
- Which staff members (teachers, administrators) and which external roles (platform providers) have access?
- Are access privileges limited to what is necessary for each role?
What to expect: a description of roles and authorization procedures.
- How are data protected (technical and organizational measures)?
- Are access controls, multi-factor authentication, and encryption used for data at rest and in transit?
- How is physical security of servers and devices managed?
What to expect: an overview of security measures; if answers are vague, ask for written evidence.
- How long are data retained?
- What are the retention periods, and what criteria determine secure deletion?
What to expect: documented retention policies and deletion procedures.
- Who are the third-party providers and where do data reside?
- Which external platforms or services process or store student data?
- Are data transferred across borders? If so, what safeguards are in place?
What to expect: a list of providers with their roles and the contractual or technical safeguards.
- Is there a data processing agreement with providers?
- Does the contract include security obligations, restrictions on use, and rules for sub‑processors?
What to expect: the ability to review the contract or receive a summary of key clauses.
- How are security incidents handled?
- Is there an incident response plan and how are parents notified in case of data loss or breach?
What to expect: clear notification timelines and defined responsibilities.
- What rights do parents and students have?
- How can one request access, correction, or deletion of data? Who is the contact for such requests?
What to expect: practical steps and estimated response times.
- Are there impact assessments or security audits?
- Have risk assessments or external audits been performed, and how often?
What to expect: summaries of checks performed and availability of audit reports.
Platform-specific questions
- Is the platform designed for education or is it a general-purpose tool?
- How are school accounts handled when a student leaves?
- Who moderates content and what rules govern sharing student images or work?
Red flags
- Vague or evasive answers about security and retention.
- Inability to provide written policies or summaries of contracts with providers.
- Unexplained data transfers or opacity about third-party processors.
How to prepare for a meeting with the school
- Bring a printed list of questions or send them in advance.
- Request written documentation (privacy notice, data processing agreement summary, retention policy).
- Involve the parent council or a trusted technical advisor if answers are technical.
Sample email to request information
Dear Principal,
Ahead of the upcoming meeting, I would like to request, if available, a copy of the privacy notice for school activities and a list of the main external providers that process student data. Specifically, I am interested in: categories of data collected, retention periods, security measures in place, and the school’s incident notification procedure.
Thank you for your cooperation.
Next steps and useful actions
- Keep copies of any policies received.
- If responses are incomplete, ask that the issue be addressed in a staff meeting or school council.
- Consider requesting an independent review or an update to the school’s policies if needed.
Conclusion
Asking clear, specific questions helps build trust and protect students’ rights. Schools should be able to explain how and why data are used; if explanations are unclear, it is reasonable to request documentation and stronger safeguards.
