The conversation about children's data usually starts with security — passwords, access, who can see what. That matters, and it is the second question.
The first is simpler and almost nobody asks it: do we need this at all?
The safest record is the one you never created
Every field you collect is something you have to protect, explain, hand over on request, and delete correctly. A field you never collected costs nothing and cannot leak.
So the useful exercise is not tightening access to your student form. It is deleting half of it.
Go through your enrolment form and ask why
For each field, answer one question: what decision does this change?
If nothing, remove it.
Fields that reliably survive that test:
- Child's name, date of birth, and current level
- Parent or guardian name, phone and email
- Attendance, homework and assessment records
- What was paid, when, by whom
- Medical or accessibility information that affects safety in the room
Fields that frequently do not survive it, and that many schools collect anyway:
- The parents' occupations and employer
- Home address, when you never send post and do not run transport
- The child's previous school, when you place by assessment
- A photograph, collected at enrolment "in case we need it"
- National ID numbers, copied because the form had a space for it
That last one deserves emphasis. A government ID number for a child sitting in a spreadsheet is one of the highest-consequence, lowest-value records a school can hold.
Photographs need consent that means something
Consent for a photo in a class record is not consent for the school's Facebook page, and one tick box covering both is not a consent anybody would defend later.
Ask separately, record the answer against the student, and make it reversible. Families change their minds, and a parent who cannot easily withdraw a photo permission is a complaint waiting to arrive.
Decide how long you keep it
Almost no school has a retention period, which means everyone's default is forever.
Pick a period for former students — long enough to reissue a certificate or answer a query, short enough that you are not holding a decade of children's records for no reason — and actually apply it.
Data you have kept for eight years for no stated reason is not an asset. It is a liability with a filing system.
Then be able to prove it
When a parent asks what you hold about their child, the answer should take minutes, not a search of four systems. Being able to export it, and to delete it and have it be gone, is what turns a policy into something true.
Schoolory gives each school its own database rather than a shared table, so deletion is a dropped database rather than a flag — the reasoning is on the trust page.