Who Holds a Student Record, and Who Decides

For who holds a student record, and who decides, think in terms of a chain: a student, an education record, a purpose, an authority, a receiver, a safeguard and a retention date. Break any link and the sharing fails, even if each other link is sound. This guide walks that chain link by link, so the reader may see exactly where a proposed sharing holds and where it breaks.

Small releases add up: a series of minor sharings may reveal a picture of a student that no single disclosing intended to create.

Role alters must trigger access reviews, or former access quietly becomes current risk.

Parental access following rights transfer depends on dependency status and on the institution's own policy, not on a parent's request alone.

Removal rights for children's information should be honoured promptly, and the removal should reach backups and subprocessors on a specified timetable.

AI grading tools create a new file in the form of the grade and the feedback, and that file inherits the protections of the underlying submission.

Equity in confidentiality means recognising that the same sharing harms different students differently, and that uniform procedures can still produce unequal risk.

Directory information is a defined subset that a college might designate and publish, and the designation must be published before it is relied on.

Early alert platforms combine academic, attendance and support information to flag students, and the combination itself is a confidentiality decision with consequences for the student flagged.

Financial aid platforms retain income and family information, and access to them ought to be among the most tightly controlled on campus.

Email may be an education file when it is maintained regarding a student, and the fact that it lives in a mailbox does not remove it from the category.

Design age screening to collect as little as possible, because screening that collects more than it needs becomes the problem it was meant to solve.

Protect applicant files on a specified schedule, even though applicants never become students in the usual sense.

Trigger access reviews on role alters automatically where possible, and treat manual review as a fallback, not as the plan.

Use external auditors where independence matters, and provide them access to the platforms they need to test, not solely to policy documents.

Run confidentiality impact assessments for new platforms, and retain the assessment with the procurement record, not in a separate folder nobody opens.

Assess biometric systems with the highest gate of all, because the data cannot be reissued if compromised.

Detect incidents early through tracking, because early detection limits the number of students affected.

Require verifiable parental consent for younger users, and do not accept a checkbox that anyone may tick as verification.

In that illustration the error is corrected, the original entry is retained with the challenge noted, and the student can see what changed.

Consider an university that adopts the same system without an alternative, and that discovers too late that some students can not or will not enroll.

The cost of fixing the badly done adoption, in renegotiation, migration and lost trust, is far higher than the cost of the review that was skipped.

In that illustration the older logs are deleted, the new period is published, and future logs expire automatically.

In that illustration the review, when it finally happens, finds tracking that was never disclosed, and the university must withdraw the app mid-term.

Documenting an emergency disclosure following the fact, from memory, is a mistake, since later reconstruction rarely convinces a reviewer.

Treating internal sharing as unrestricted is an error, since internal recipients still need a purpose and authorization for the file.

Writing a policy that staff cannot state without opening the document is an error, because the policy will not be followed under time pressure.

This guide does not substitute for a college's own policies or counsel, and a conflict between the two should be resolved in favour of the college's own advice.

Giving a small institution no shared-service option for privacy review is a mistake, because an institution without a dedicated officer still carries the same duties.