Schools collect a remarkable amount of personal data: names, dates of birth, addresses, parents' phone numbers, photos, medical notes, fee and bank details. Most of it relates to children. Yet in many schools, data security isn't anyone's specific job. This checklist is written for principals and administrators, not IT specialists. Go through it once a year.

Access

1. Does everyone have their own login? Shared office passwords make it impossible to know who did what. Every staff member should have an individual account.

2. Do people only see what they need? A class teacher needs their students' records, not the whole school's fee ledger. Role-based access should limit each person to their job.

3. Are leavers removed promptly? When staff leave, their access should end the same day. Check for old accounts every term.

4. Are passwords strong, and is two-step login available? At minimum for admin and accounts staff.

Where the data lives

5. Do you know where your data is stored? Ask your software vendor where the servers are and how the data is protected — both in transit and at rest.

6. Is it backed up automatically? And has anyone ever tested restoring a backup?

7. How much lives in spreadsheets and personal phones? Copies of student lists on personal laptops, USB drives and WhatsApp are the most common leak. Reduce them by keeping data in one secure system.

Sharing

8. What do parents see? Parents should see only their own child's information. Watch for class WhatsApp groups that expose every parent's phone number — one reason to move tasks like PTM scheduling out of group chats.

9. Is location data scoped? If you use bus tracking, a parent should see their own child's bus, not every route.

10. Who else receives your data? List every third party — payment gateways, messaging providers, app vendors — and check each has a reason to have it.

Policy and consent

11. Do parents know what you collect and why? India's Digital Personal Data Protection Act places specific responsibilities on organisations handling personal data, with particular care required for children's data. Our plain-English summary of the DPDP Act explains what it means for schools. For specific legal obligations, take advice from a qualified professional.

12. Do you have a plan if something goes wrong? Know who to call, how to tell affected families, and how to lock accounts quickly.

Questions to ask your software vendor

Where is our data hosted, and is it encrypted?
How often is it backed up, and how quickly can it be restored?
Which of your staff can access our data, and is that access logged?
Can we export all our data if we leave — and is it deleted afterwards?

These belong on any shortlist — they're part of our buyer's guide to school software.

Security is mostly habits

Good software helps, but most incidents come from everyday habits — a shared password, an exported list on a personal phone. A short annual review with this checklist catches most of them. Schoolo uses role-based access, encryption in transit and at rest, audit logs and automated backups; you can read more on our about page.