Questions every school should ask a platform before sharing student data
Before your students' data leaves the school, ask the platform eight groups of questions: what data, why, where it is stored, who can see it, how long it is kept, how it is deleted, what happens when the contract ends, and whether it reaches an AI model. A good answer is specific and in writing; a vague or spoken one is a warning sign.
Question sheet before sharing student data
A free printable PDF, no sign-up.
This page is for the principal, the owner and the IT lead, in the week before the school signs up to a new platform or starts a trial — a management system, a learning platform, a classroom app or an AI tool. It holds questions, not claims: you send them to the platform in writing and judge every answer by the same standard, whoever the company is.
The idea is not new. CoSN, the US association of K-12 education technology leaders, publishes “Privacy Questions for Service Providers”. It advises districts to start with the privacy policy and terms of use, then look for what the policy leaves out, and to sign only once they are satisfied the provider's practices are adequate. The list is written for American schools and American law, but its questions work for any school.
The question sheet: eight groups, each with a good answer and a warning sign
| Group | The question | A good answer sounds like | Warning sign |
|---|---|---|---|
| 1. What data | What personal data will you collect about students, teachers and parents? What is the minimum the service needs to work? | A written list of fields, with required and optional kept apart | “We only collect what we need”, with no list |
| 2. Why it is collected | What is each kind of data used for? Is any of it used for advertising, sold, or used to build profiles of students? | A purpose for each kind, and a plain line in the contract that data is never used for ads or sold | “To improve our services”, with no limits |
| 3. Where it is stored | In which country is the data stored? Which other companies reach it, such as the hosting provider and analytics tools? | The country by name, and a list of the other companies and what each one reaches | “In the cloud”, or a refusal to name the other companies |
| 4. Who can see it | Who sees the data inside your company and inside the school? How will you tell us if someone who should not see it does? | Defined roles for each user, a log of who opened what, and a written deadline for telling the school about any incident | “Our whole team can help”, and no committed deadline |
| 5. How long it is kept | How long do you keep each kind of data once it is no longer needed? | A period for each kind, written in the policy or the contract | “As long as necessary”, or indefinitely |
| 6. How it is deleted | Who can ask for deletion, how long does it take, does it cover backups, and do we get written confirmation? | Steps with a set time frame, backups named, and written confirmation afterwards | “You can delete your account”, and nothing more |
| 7. End of the contract or free year | What happens to our data if the contract ends, or the free year ends and we do not subscribe? In what format can we export it? | A full export in a common format such as CSV at no charge, and a written grace period before deletion | Data that only leaves after payment, or no export at all |
| 8. Use in AI | Is student data sent to an AI model? Which provider? Is it used to train the model? Can the school switch that off? | The provider by name, a clause that forbids training models on student data, and a setting that turns the feature off | “Our AI is safe”, with no detail |
One rule sits behind the last column: an answer that cannot be written into the contract is not an answer yet. If a platform will not answer a question in writing, that is an answer too.
How to use the sheet in one week
Read the privacy policy before you send anything
Many answers are already there. What you cannot find there is the question worth following up — which is exactly what the CoSN list advises.
Send the questions in writing before the demo
Ask for answers by email, not in a meeting. A written answer can be compared and copied into the contract; a spoken one is gone in a week.
Split the reading between three people
The owner or principal reads the purpose and end-of-contract groups; the IT lead reads storage, access and deletion; the academic head reads what concerns students and AI.
Move every promise into the contract
Whatever the platform promised by email belongs in the contract or in the data protection agreement attached to it. Verification, as CoSN puts it, comes before signing, not after.
Compare platforms on the same sheet
If you are choosing between two platforms, ask both the same questions and write the answers side by side. If you are not yet sure which kind of system you need, the difference between a school management system, an LMS and a school OS helps before you start.
Do not leave these questions until after the pilot. In a 2022 study by The Decision Lab of more than 225 edtech decision-makers in US school districts, reported by EdSurge in June 2024, checking privacy requirements was part of the evaluation stage, which comes before the pilot and the purchase.
Why each group: the mistake it prevents
- What data and why: CoSN points out that a student can use a product without creating an account and still have personal information collected. Do not assume that no sign-up means no data.
- Where it is stored and who sees it: the companies working behind a platform reach the data too, and knowing who they are is the only way to check it is used solely for the purpose you agreed.
- Incident notice: “promptly” is a flexible word. CoSN suggests the school set a reasonable time frame that spells out what it means by “without undue delay” — and get it in writing.
- Policy changes: ask whether the platform will tell you before it changes its privacy policy. A material change — using data already collected for a new purpose, for instance — should, in CoSN's view, happen only with the school's consent.
- How long and how deleted: the rule CoSN gives is to keep data only as long as the purpose it was provided for requires, and for the school to know the period so it can decide whether it agrees.
- End of the contract or free year: this is where the surprises are. A question not asked before signing gets asked after it, from a weaker position. More in what to ask before the free first year ends.
- Use in AI: this is where data can leave for a third party without anyone noticing. Make the answer part of your school's AI policy.
What the law says: Jordan's personal data protection law as an example
These questions do not replace the law, and each country has its own. In Jordan, the Personal Data Protection Law, No. 24 of 2023, was published in the Official Gazette on 17 September 2023 and came into force on 17 March 2024, according to a summary by the law firm Clyde & Co published on 17 October 2023. Among the points it lists:
- Consent to processing must be clear and in writing, for a specified period and purpose.
- The person the data is about has rights, including access, correction, withdrawing consent and, under conditions, erasure.
- Data may not be transferred outside Jordan where the recipient's level of protection is lower than the law's. That makes the third group's question — which country — a legal question as well.
- For a breach causing serious harm, the controller must inform the people concerned within 24 hours of discovering it, and the regulator within 72 hours.
- A data protection officer must be appointed in certain cases, including processing the data of persons lacking legal capacity.
How far enforcement has reached today is something we could not settle from a published source; the same summary expected a grace period for compliance until March 2025. So ask the school's lawyer before you rest a decision on any clause, and ask the platform to name the law it complies with in its answer. If your school is in another country, ask for the same thing: the name and number of the law the platform follows there.
Frequently asked questions
- What counts as a student's personal data?
- Any information that identifies a particular student or could: name, ID number, class, grades, attendance, what they write inside the platform, and the record of how they use it.
- Isn't the privacy policy enough?
- Start with it; many answers are there. But what the policy does not say is what is worth asking, and what is not in the contract cannot be claimed later.
- How do we protect student data privacy at school?
- Share with any platform only what it needs to work, get written answers to the eight groups of questions before signing, and review once a year who can reach what.
- Does the school need a lawyer?
- For the contract, yes — especially the clauses on moving data out of the country. The school's own team asks the questions, so the lawyer starts from written answers instead of from nothing.
Sources
Every fact in this post that we did not produce ourselves comes from one of these sources.
- Privacy Questions for Service Providers (CoSN Student Data Privacy Initiative) — CoSN — the Consortium for School Networking, 2024-05 (upload date in the file's address; the document is undated)
- Jordan issues first personal data protection law (Lamisse Bajunaid) — Clyde & Co, 2023-10-17
- How District Leaders Make Edtech Purchasing Decisions (Caitlin McLemore and Jayden Rae) — EdSurge, 2024-06-24
Written with String's editorial team: we use AI for research and first drafts, and a person checks every fact and every source before anything is published. How we write
Founder and CEO, String
“I grew up in a house of teachers.” I spent a year designing the STEM program for one of the largest school groups in Saudi Arabia, have written curriculum by hand, trained robotics coaches and sold software into schools, then left that job to build String in Amman.
