Talk to sales

A Data Privacy Act checklist for choosing school software

A school that puts learner records in software stays responsible for them. What the Data Privacy Act of 2012 asks of your school, and what to ask of any vendor before you sign.

Moving learner records into software does not move the responsibility for them. Under the Data Privacy Act of 2012 (Republic Act No. 10173), your school remains accountable for the personal information it collects, including the parts a vendor holds for you. This checklist covers what that means when you choose and run school software.

It is general guidance, not legal advice. For your school's specific obligations, the National Privacy Commission and your own data protection officer are the authority.

Who is responsible for what

The law gives the two sides different names and different duties.

  • Your school is the personal information controller. It decides what is collected about learners, families and staff, and why. It stays accountable for that data, wherever it is processed.
  • The software vendor is a personal information processor. It processes the data on your school's instructions, and only for the purposes you agree.

Much of what a school keeps is sensitive personal information under the Act, which includes a person's age, health and education records. Grades, clinic visits, guidance notes and birthdates all qualify, so they call for stronger protection than an ordinary contact list.

Ask before you sign

Put these to any vendor, and get the answers in the contract, not only in the demo.

  1. Is our data kept apart from other schools'? Ask how one school's records are separated from the next, and whether a mistake in one school can expose another.
  2. Who at the vendor can see our data, and when? Access by the vendor's own staff should be limited, recorded, and only for support you asked for.
  3. Can we control who sees what? A cashier does not need guidance notes; a guidance counselor does not need the fee ledger. Look for roles, not one shared login.
  4. Is every change recorded? An audit trail that shows who changed a grade or a record, and when, is how you answer a complaint.
  5. How do people sign in? Two-factor sign-in for staff should be available, and on for anyone who can see sensitive records.
  6. What happens in a breach? The NPC expects a controller to notify it and the affected people within 72 hours of learning of a qualifying breach. Your vendor has to tell you fast enough for you to do that.
  7. Is the vendor registered with the National Privacy Commission? Ask, and ask who their data protection officer is.
  8. What happens when we leave? The contract should say how your data comes back to you, in what format, and when the vendor's copy is deleted.

After you switch

  • Update your privacy notice. Families should be told what is collected, why, and who processes it, including the vendor.
  • Give each person the least access their job needs. Review roles at the start of every school year, and remove people who have left.
  • Keep your data protection officer in the loop. Your DPO should know which systems hold learner data and who the vendor's contact is.
  • Check your NPC registration. Depending on its size and what it processes, your school may need to register its data processing systems with the NPC. Check the NPC's current registration rules.
  • Practise the breach plan. Know who decides, who notifies the NPC, and who writes to families, before you need to.

Learners are minors

Most of a school's data subjects are children, and the people who exercise their rights are usually their parents or guardians. A few things follow from that:

  • Parents and guardians need a clear way to see, correct and ask about their child's records.
  • Some records should not reach parents at all. Confidential counseling notes are the obvious case.
  • Health and wellbeing data deserves the tightest access in the school.

In SchoolAide Pro, each school's records live in their own isolated space, on their own domain. Roles decide who can view, edit, approve or release; every change is on an audit trail; and the platform apps sign staff and families in with two-factor sign-in and passkeys. Guidance keeps confidential counseling cases, the Clinic amends its records rather than overwriting them, and in SchoolAide Mobile a student's Reflect check-ins are visible only to that student. Rakso Ed is registered with the National Privacy Commission, and our privacy policy says how we handle what we process.

Comparing systems on more than privacy? Our guide to choosing school management software in the Philippines covers the rest.

In this guide

Keep reading