Teaching · For Teachers

A data governance policy your team can actually finish.

Answer for the data you hold, who owns it and what you already do. The builder drafts the policy in eight numbered sections and lists the practices still to build.

Start a policy draftWhat you get
$19one-time · every device you sign in on
Buy · $19

Included with Caveat Classroom and Whole-school licenses. Or get it in the For Teachers toolkit, $79 for 84 items.

The policy builder

One draft per school or district. The example district is made up.

Loading the form. If nothing appears, turn on JavaScript.

What you get

Teaching · For Teachers$19 · included with Classroom and Whole-school licenses

What you finish with
A first draft of a data governance policy in eight numbered sections, with a list of practices not yet in place.
Who it is for
District data and accountability leads, principals, technology directors and school data teams.
Format
Browser builder. One saved draft per school or district; printed with the draft or as a blank form; CSV of the roles; export and import a file.
Access
$19 one-time, yours on every device you sign in on; the tool opens once you are signed in with it. Included with Caveat Classroom and Whole-school licenses. Also in the For Teachers toolkit ($79) and the Teaching Suite pass ($199), and 1 more bundle. Everything you type stays in this browser; nothing is sent to Caveat.
Where it lives
The For Teachers space in Caveat Teaching.
Support
Questions about an order, access or a correction: team@caveatacademic.com.
directoryinternalconfidentialPolicymore sensitive, fewer eyes
Drawn for this page. Classifying each kind of data sets who may see it; the policy then says how access, sharing, incidents and retention work for each class.

How to use it

  1. Gather the data lead, a technology lead and a special education lead to fill it in together.
  2. Use role titles so the policy survives staff changes.
  3. Classify each kind of data before you write access rules.
  4. Take the draft to legal counsel and add your state’s requirements.
  5. Redo the gaps list each year.

Start a policy draft

How the draft is built

Why classify first

Access, sharing and incident rules follow from how sensitive the data is. Special education and health records usually sit in the most protected class.

Vendors as school officials

Under FERPA a school can share records with a vendor without consent only when the vendor does a job staff would otherwise do, is under the school’s direct control for the data, and uses it only for that job.

What it is not

The draft covers federal requirements only. States often add laws on vendor contracts, breach notice and retention; check them before adoption.

Sources

  1. Family Educational Rights and Privacy Act, 34 CFR Part 99, including 99.7 (annual notification), 99.31(a)(1) (school officials) and 99.37 (directory information).
  2. Protection of Pupil Rights Amendment, 20 U.S.C. 1232h, and 34 CFR Part 98 (surveys on protected topics).
  3. U.S. Department of Education, Privacy Technical Assistance Center. Data Governance Checklist, and Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices.
  4. National Forum on Education Statistics. Forum Guide to Data Governance, 2020.
  5. Cybersecurity and Infrastructure Security Agency. Protecting Our Future: Partnering to Safeguard K–12 Organizations from Cybersecurity Threats, 2023 (multi-factor authentication).

The example district, titles and practices are made up. Support: team@caveatacademic.com.