Student privacy: the standard above the legal minimum

Why children’s data is different

Children cannot meaningfully consent to processing they do not understand, and they did not choose the school’s systems. Attendance is compulsory, so there is no opting out of the relationship the way there is with a shop.

The data also follows them. A behavioural note written about an eight-year-old can still be on file when they are seventeen, and the context that made it reasonable at the time is long gone. Retention is not an administrative detail here; it is the whole question.

Recital 38 of the GDPR says children merit specific protection because they are less aware of the risks. That is a direction of travel, not a checklist — which is exactly why the legal minimum is the wrong target.

What "above the floor" means in practice

• Collect what the purpose needs rather than what the form has always asked for. Most enrolment forms gather fields nobody has used in a decade.
• Write notes about a child as though the child will read them at eighteen, because they may.
• Delete on the retention schedule rather than keeping everything in case. Holding data you no longer need is a risk with no upside.
• Tell parents what you do in plain language, not only in the privacy notice nobody opens.
• Ask of any new system what it does with the data after the contract ends, before signing rather than after.

The practical argument

There is a self-interested case too, and it is worth stating rather than relying on principle alone. A school’s relationship with its families is its most valuable asset and it is unusually easy to damage. One mishandled file, one disclosure to the wrong parent, and a school spends a year rebuilding something that took a decade.

Doing more than the minimum is cheaper than the alternative, and the parts of it that are written down — a retention schedule, a clear privacy notice, a policy somebody approved — are also the parts that answer a regulator.