FERPA, GDPR and school data privacy: what to ask a vendor

Student data is not ordinary customer data. A school platform holds guardians, attendance, grades, health notes, special education plans and, in some regions, safeguarding records. The laws differ by country. The questions worth asking a vendor are remarkably similar.

SchoolManagee is built to support FERPA and COPPA in the United States, GDPR and UK GDPR, PIPEDA in Canada, and the Australian Privacy Principles. “Built to support” means the product has the controls those regimes expect. It is not a substitute for your own policies, your DPA or a signed data-processing agreement.

Access, not just a password

Role-based access control is the first control. A teacher should see their classes. A nurse should see health notes. A parent should see their own children. A safeguarding lead should see notes that a substitute teacher never sees. Single sign-on with Google or Microsoft matters because schools already know how to turn a leaver off in the directory.

Encryption and where the data sits

Ask whether data is encrypted in transit and at rest, and which region it is hosted in. A US district, a UK trust and an Australian school should not have to share one implied data centre. SchoolManagee offers hosting regions for North America, the UK/EU and Australia so residency can match the school.

Proof after the fact

Audit logs answer the question every privacy officer eventually gets: who viewed or changed this record? Every change should be traceable. Confidential child-protection notes should be restricted to designated staff, not just “hidden” on a tab the rest of the staff can still open.

Also ask the unglamorous questions. How long is data kept? How do you export it if you leave? Who are the subprocessors? How do you handle a parent access request? Those answers belong in the contract and in your privacy notice, not only in a sales slide.

What this does not replace

A vendor checklist does not make a school compliant. Staff still need a reason to look at a record, a process for consent where consent is required, and a named person when a family asks for data. The software’s job is to make the careful path the easy path: least-privilege roles, regional hosting, encryption and a log you can actually read.