Data Governance: Six Rules a School Should Settle First

The most common failure in using learning data is not technical. It is starting to collect data before anyone has set the rules. If nobody has decided who may see what, when data has to be deleted, or who is answerable when something is wrong, even the best-built dashboard eventually becomes the seed of a dispute. Governance is not a brake on using data; it is the seatbelt that lets you drive with your mind at ease.

Six things to settle before you collect anything

Agree on these in writing, and then begin collecting. Reverse the order and you pay a far more expensive bill later.

1. State the purpose of collection: A vague purpose like "supporting learning" won't do. Set the principle that data with no concrete use is not collected. Only a clear purpose tells you how far to collect.
2. Tiers of access: Spell out how far the homeroom teacher, the subject teacher, the administrator, and the counselor each get to see. A structure where everyone sees everything is the most dangerous one.
3. Retention period: Fix the point after the term ends when data is deleted automatically. Keeping it indefinitely means holding the biggest risk forever.
4. Notice to students and parents: Explain what you collect and why in plain language, with no jargon. Consent presupposes understanding.
5. No use beyond the stated purpose: Data gathered to support learning is not used as grounds for discipline in the student record. The moment you exceed the stated use, trust collapses.
6. A correction process: Give students a channel to fix what was recorded wrongly. Data carries a right to correction too.

Whether you can collect data and whether you may collect it are entirely different questions.

Review habits once you are running

Even after the rules exist, without a regular review they quickly turn into paper.

• Revisit access rights every quarter. If transfers and role changes never get reflected, permissions quietly leak.
• Build the response procedure for a data breach in advance and rehearse it once before an incident, not after one. A procedure you never practiced will not work in the moment of crisis.
• Before entering student data into an outside tool, check where that tool processes data and what its retention policy says. The more free the tool, the more carefully you should look.
• Log who viewed which data and when. When accountability is visible, everyone is careful.

When schools first set up governance, they often get stuck trying to write the perfect document and never start. A one-page agreement is plenty: the list of data to be collected, the access table, the deletion date, and the name of the person responsible. Write down those four and you have crossed the starting line. Add a line whenever you spot a gap in practice. What matters is not the length but the fact itself - that the people in the school agreed on the same rules before anyone touched the data.

Key takeaways

Learning data governance is not regulation but the design that holds trust up. Agree on all six - purpose, access, retention, notice, no secondary use, correction - before you collect, and using the data actually becomes freer. The clearer the rules, the more teachers can use data without anxiety, and the more safely students can hand it over.