Enrichment · Wellbeing

Collect less,
protect more.

Every permission form, sign-up app and shared spreadsheet is a place student data can leak. Take one at a time: what it is for, what sensitive data it holds, how many students, and eight checks on whether it collects only what it needs and keeps it only as long as it should. The page lists what to fix, starting with the riskiest fields.

Check a collectionWhat you get

Data collections

The worked example is made up: four collections at one middle school, named by form, not by student. Saved on this device only.

Loading the collection form. If nothing appears, turn on JavaScript.

What you get

Enrichment · WellbeingFree

What you finish with
A checklist for each student data collection: kind, the role responsible, purpose, sensitive data held, about how many students, eight minimization checks and a retention date. Counts checks met across collections and collections holding Social Security numbers; flags the riskiest fields and lists every check not yet met.
Who it is for
Teachers, coaches, club advisors, counselors, front office staff and administrators; school technology and privacy leads running a check across a building.
Format
Browser checklist with a saved record per collection. Prints one checklist, every collection in a table or a blank form; downloads a spreadsheet (.csv); exports and imports a file.
Access
Free. No account, no sign-in and nothing to install. Everything you type stays in this browser; nothing is sent to Caveat.
Where it lives
The Wellbeing space in Caveat Enrichment.
Support
Questions about access, an order or a correction: team@caveatacademic.com.

How to use it

  1. List the forms, apps, spreadsheets and folders you use that hold student data.
  2. For each, write its purpose and tick the sensitive kinds of data it holds.
  3. Work through the eight checks: yes, not yet, or does not apply.
  4. Set a date to delete the data or check again.
  5. Fix the flagged fields first, then the checks marked not yet.

Check a collection

What data minimization means in a school

Five questions before collecting1Why do we need it?Write the purpose. No purpose,no field.2Is there a less sensitive field?Grade instead of birth date,ID instead of name.3Who can see it?Only the staff who need it forthat purpose.4How long do we keep it?Set a date to delete it orcheck again.5Who else gets it?Vendors need a signed privacyagreement.Five questions before collecting1Why do we need it?Write the purpose. No purpose, no field.2Is there a less sensitive field?Grade instead of birth date, ID insteadof name.3Who can see it?Only the staff who need it for thatpurpose.4How long do we keep it?Set a date to delete it or check again.5Who else gets it?Vendors need a signed privacy agreement.
Data you never collect cannot be lost, leaked or misused. The smallest data set that does the job is the safest one.

The law sets the floor

FERPA protects education records and limits disclosure without a parent’s consent, with exceptions such as school officials with a legitimate educational interest. For online services, the U.S. Department of Education’s guidance recommends written agreements that limit how a vendor uses and keeps data. Many states add their own student privacy laws; check your district’s policy.

Less is safer

Data minimization means collecting only what a purpose needs and keeping it only as long as it needs. It is a basic principle in privacy frameworks because data that was never collected cannot be breached.

The riskiest fields

Social Security numbers, immigration or citizenship status, biometric data, health and disability details and discipline records do the most harm if exposed. Ask whether each is truly required, and by what.

Sources

  1. Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g; 34 CFR Part 99 (studentprivacy.ed.gov).
  2. U.S. Department of Education, Privacy Technical Assistance Center (2014). Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices.
  3. Federal Trade Commission: Children’s Online Privacy Protection Rule (COPPA), on services directed to children under 13 (ftc.gov).
  4. Plyler v. Doe, 457 U.S. 202 (1982).
  5. National Institute of Standards and Technology (2020). NIST Privacy Framework, version 1.0, on data minimization.

The worked example is made up. This checklist supports good practice; it is not legal advice, and state and district rules differ. Nothing you type is sent to Caveat. Support: team@caveatacademic.com.