A school holds some of the most sensitive data in any community: identity numbers, home addresses, family contacts, health notes, grades, photos and, if you run buses, where a child is at certain times. Privacy laws now make the school responsible for how this data is collected, used, shared and kept. In Saudi Arabia the main law is the Personal Data Protection Law (PDPL), supervised by SDAIA. In Egypt it is the Personal Data Protection Law, Law No. 151 of 2020, and its regulations. This checklist is general guidance to organise your work. It is not legal advice, so ask a qualified adviser to confirm what applies to your school.
1. Know what data you hold
You cannot protect what you have not listed. Make a simple register:
- Categories. Student identity and contact data, parent and guardian data, staff data, academic records, attendance, health and clinic notes, behaviour records, financial data, photos and videos, location data from buses, CCTV.
- Where it lives. The school system, spreadsheets, WhatsApp groups, email, paper files, personal phones of staff.
- Who can see it. By role and by branch.
- Why you hold it. Each category should have a clear purpose, such as enrolment, safety, teaching or billing.
If you cannot give a reason for a piece of data, stop collecting it.
2. Be clear about the legal basis and consent
Many school activities rest on the school's duty to educate and to run the contract with the family. Other uses need clear consent, for example publishing student photos on social media or sharing data with a third party for marketing. Children cannot give consent alone, so ask the parent or guardian, record when and what they agreed to, and let them withdraw. Keep consent separate from the enrolment form so that refusing a photo does not block enrolment.
3. Tell people what you do
Publish a privacy notice in plain Arabic (and English if relevant) that explains what you collect, why, who receives it, how long you keep it and how to contact the school about it. Make it easy to find in the parent app and on the website.
4. Make rights easy to exercise
Individuals have rights such as being informed, accessing their data, asking for corrections and, in some cases, asking for deletion. Decide who receives requests, how identity is checked, the time limit for answering and where each request and answer is recorded. A request log inside your system is better than an email thread.
5. Limit access
- Give each role only the access it needs: a teacher sees their classes, the accountant sees fees, the nurse sees health records.
- Separate branches so that one campus cannot browse another's students unless there is a reason.
- Use individual accounts, never shared passwords, and turn on two-factor sign-in for administrators.
- Remove access on the day a staff member leaves or changes role.
- Keep an audit log of sensitive actions, such as viewing health records or exporting lists.
6. Secure the data
- Use HTTPS for every connection and encrypt devices that hold student data.
- Keep backups and test restoring them.
- Do not send class lists, IDs or health notes in group chats or personal email.
- Train staff on phishing, password hygiene and what to do with a lost phone.
- Avoid storing student data on personal devices unless the school can manage them.
7. Decide how long you keep data
Not everything should be kept forever. Set retention periods per category (for example, health notes, bus trip records, applicant files for children who did not enrol) and a routine to delete or anonymise when the period ends. Keep what regulations or contracts require, and no more.
8. Choose and manage vendors carefully
Any company that handles your data on your behalf is your processor, and you remain responsible. Ask each vendor:
- Where is the data hosted, and does it leave the country?
- Which of its staff can access it, and how is that access logged?
- What happens to the data when the contract ends, and in what format can you export it?
- How does it notify you of a security incident, and how quickly?
- Does it use your data for anything beyond the service?
Put the answers in the contract.
9. Prepare for incidents
Write a one-page plan before something goes wrong: who leads, who investigates, who is told (families, the regulator when the law requires it) and how fast. Practise it once a year. A lost phone with parent contacts and a mis-sent email with a class list are the incidents that actually happen, so include them.
10. Assign ownership
Name someone responsible for data protection, even if it is part of another role, and review this checklist every term and whenever you add a new system, camera or service.
How Classti supports the checklist
Classti was designed with per-role and per-branch permissions, separate data for each school, two-factor authentication, an audit log of sensitive actions, encrypted connections and a privacy centre for consents and data requests aligned with the PDPL. We discuss hosting and data handling with each school during the demo. To go deeper, see parent communication, the clinic module and the Saudi-focused page School management system in Saudi Arabia, or book a demo.