The sector with the least regulator-specific guidance — which is exactly why a clear, written program is worth so much here.

Why this sector is harder than it looks

Schools hold sensitive personal information about minors, which is the most scrutinised category of processing there is — and they receive less sector-specific guidance than health or finance.

That combination cuts both ways. There is less prescriptive detail to comply with, and correspondingly more room to get it wrong. A written program that states clearly how the school handles each situation is worth more here than almost anywhere else, because there is no regulator template to fall back on.

The situations that come up

Most of a school's privacy risk sits in ordinary daily practice, not in systems:

• Honor rolls, awards lists and photographs published without a consent basis
• Learning management systems and video conferencing adopted quickly, with no Privacy Impact Assessment behind them
• Requests for records from a non-custodial parent, where a policy decision has to be made under pressure
• Alumni and marketing communications using data collected for enrollment
• Classroom and corridor CCTV, under NPC Circular 2024-02
• Third-party providers — bus operators, canteen concessionaires, photographers, yearbook publishers — receiving student data with no agreement in place

What the overlay covers

• Transparency written for children as well as for parents, per NPC Advisory 2024-03
• Consent and legitimate interest mapped for each publication and communication type
• PIAs for the learning platform, the student information system and video conferencing
• A records retention schedule spanning enrollment through alumni relations
• A written procedure for parental and student access requests
• Staff training pitched at teachers and registrars rather than at IT