A Practical Student Privacy Checklist for Small Online Schools

Online schools rely on a connected set of tools: learning platforms, video classrooms, forms, payment systems, messaging apps, assessment tools, cloud storage, and more. Each can create, receive, store, or share information about a student. For a small school, the challenge is rarely a lack of good intentions. It is making privacy work visible, owned, and repeatable while teaching continues.

This checklist is a practical starting point for online school owners and academic leaders. It is not legal advice or a substitute for checking the rules that apply to your school, students, location, and contracts. Use it to create a clear operating picture, identify unanswered questions, and give staff a consistent process before adding new tools or sharing student information.

Start with one principle: know your data flow

A privacy programme becomes much easier to manage once your school can answer a simple question: what student information do we have, where does it go, who can access it, and why? NIST’s Privacy Framework identifies inventory and mapping as a foundation for understanding and managing privacy risk. For a small school, this does not need to begin as an elaborate compliance project. A well-maintained spreadsheet can be a useful first data map.

1. Create a student-data map

List every system or process that handles student information, including processes that live outside your main learning platform. Include the full student journey: enquiry, enrolment, learning, support, assessment, communication, graduation or withdrawal, and deletion or retention.

Do not forget the less obvious locations: teachers’ downloaded class lists, email attachments, chat exports, shared folders, personal device downloads, helpdesk tickets, and recordings created by staff. The aim is not to eliminate every data flow. It is to make each one intentional and reviewable.

Control permissions before there is a problem

2. Use role-based access, not convenience-based access

Give each person the least access that lets them do their job. A tutor may need access to their class roster and submitted work, while a finance colleague may need billing information but not learning records. An external specialist may need a limited set of materials for a defined period, rather than an all-school account.

• Create standard roles such as owner, academic leader, teacher, tutor, administrator, finance colleague, and contractor.
• Document which systems and data categories each role can access.
• Use individual accounts rather than shared staff logins wherever the tool allows.
• Remove or reduce access promptly when a staff member changes role, finishes a contract, or leaves.
• Review privileged accounts, such as platform administrators and cloud-storage owners, on a regular schedule.

Permissions are also a teaching-quality issue. Clear access makes it easier for staff to find the information they genuinely need without normalising broad access to every student record.

Make recordings a deliberate teaching decision

3. Set a recording policy for live lessons and meetings

Video lessons may capture more than planned: student names, voices, faces, chat messages, screens, family members in the background, or sensitive comments made during a lesson. Decide in advance when recordings are educationally necessary and when they are not.

• State which sessions may be recorded and the educational purpose for recording them.
• Tell students and families, in clear language, how recordings will be accessed and for how long they will be available.
• Set host controls so that only authorised staff can start, store, download, or share recordings.
• Check whether recordings include chat, captions, attendance reports, transcripts, or shared screens, not only video.
• Provide an escalation route for sensitive disclosures or accidental capture of inappropriate information.
• Apply a scheduled review and deletion point instead of allowing recordings to accumulate indefinitely.

Keep a distinction between a lesson resource and a permanent record. A recording that is useful for a short catch-up period may not need to stay in a student-accessible library after the course or term ends.

Approve vendors, not just apps

4. Keep a vendor register and a simple approval gate

Education privacy guidance from the U.S. Department of Education encourages schools to inventory and evaluate online educational services and to review terms of service. Treat every supplier that processes student information as a vendor, whether it provides video conferencing, forms, assessment, communications, storage, identity management, or an AI-enabled learning feature.

Before a new tool reaches students, assign one accountable reviewer and record the decision. Avoid a situation in which a well-meaning teacher asks learners to create accounts for a service that the school has not assessed.

Questions for every vendor review

1. What student information is needed to use the service?
2. Can the school limit collection to the minimum needed for the stated learning purpose?
3. How does the vendor describe its collection, use, sharing, security, and deletion practices?
4. Does the school control account creation, permissions, and data export?
5. Can staff disable unnecessary features, public profiles, direct messaging, or third-party integrations?
6. What happens to data when the contract, subscription, or course ends?
7. Who at the school owns the relationship and reviews changes to terms or product settings?

Save the version of the agreement, privacy notice, and approval record that informed the decision. Terms and features can change, so set a review date rather than treating approval as permanent.

Turn deletion into a scheduled process

5. Maintain a retention and deletion schedule

Retention is not the same as keeping everything forever. Department of Education guidance notes that some student information may need to be preserved for a defined period or longer, while other information can become unnecessary after a student leaves. Your school should distinguish records that must be retained under applicable requirements from temporary operational material.

Create a schedule that names each category, its owner, the reason for retaining it, its review date, and the deletion or archival method. For example, separate formal academic records from temporary exports, duplicate files, expired access links, lesson recordings, support tickets, and abandoned trial accounts.

• Set a termly or quarterly deletion review for collaboration spaces and recordings.
• Check that departed students and staff no longer have active accounts or access links.
• Delete local downloads and duplicate exports when the approved system remains the source of record.
• Ask vendors what deletion means in practice, including backups, account closure, and confirmation processes.
• Keep an internal log of significant deletion actions and exceptions.

Never set retention periods by guesswork. Confirm recordkeeping duties, contractual commitments, and any applicable jurisdiction-specific requirements before finalising the schedule.

Handle consent and family communication with care

6. Separate clear communication from assumptions about consent

Parents and eligible students may have rights concerning education records under FERPA where that law applies. Separately, the FTC explains that COPPA can apply to operators of online services directed to children under 13, or operators with actual knowledge that they collect personal information online from children under 13. Whether, when, and how a school can act in relation to parental permission depends on the facts and applicable law.

Operationally, keep a consent and notice register that records what was communicated, to whom, on what date, for what specific activity, and where the evidence is stored. Do not use one broad checkbox as a substitute for understanding the purpose of a collection or disclosure.

• Write family-facing notices in plain language, avoiding legal jargon where possible.
• Explain the learning purpose, the tools involved, the information used, and available choices or alternatives where appropriate.
• Use a process to verify parent or guardian authority when your policy or applicable requirements call for it.
• Record withdrawals, objections, and access requests so staff can act consistently.
• Revisit notices when introducing a materially different tool, recording practice, or data use.

Put the checklist into a small-school routine

Assign one operational owner for the privacy checklist, but do not make privacy a one-person task. Academic leaders should decide whether a tool supports teaching. Administrators should manage account and vendor records. Teachers should follow approved classroom practices. School leaders should make final decisions when a proposed use presents a meaningful risk or uncertainty.

A workable cadence is often enough: review new tools before adoption, check access changes monthly, review recordings and temporary workspaces at the end of each term, and review the full data map and vendor register at least annually. Keep decisions short, dated, and retrievable.

Small-school standard: if you cannot explain what a tool does with student information, who can access it, and how the school will end access or delete data, pause implementation until you can.

Privacy work should support, not replace, professional judgement. Teachers still decide what is educationally appropriate; the school’s systems should make the safer, documented option the easier one to follow.

Use privacy operations to reduce repetitive admin

A consistent workflow for approvals, class access, content ownership, and review points can reduce the administrative drag around online learning. SubSchool is built to automate repetitive teaching work while teachers retain authorship and the final educational decision. If you are reviewing how your school’s operating processes support teaching, learn more about SubSchool.