Before a school signs with an app or photographer: 10 privacy questions to ask

A school may use an attendance app, payment platform, learning system and event photographer in the same week. Each can receive student or parent information. Before signing a contract, ask the same basic question: what happens to that information after it leaves the school's hands?

Use these questions as a starting point for procurement and legal review.

Ask what the vendor needs and why

1. What information will you receive? Ask for a list, including photographs, account details, contact details and any sensitive context. Avoid sharing fields that are not needed for the agreed service.
2. What exactly will you use it for? Request a clear description. Ask whether the vendor wants to use the information for its own marketing, product development or other purposes.
3. Who else will access it? Identify subcontractors and service providers, including those involved in storage and support.

Ask how information is protected

1. How is access restricted? Ask who can view, download or change data and how access is removed when a staff member leaves.
2. How is data protected in storage and transit? Request a plain-English explanation of safeguards and evidence appropriate to the risk.
3. What happens after a security incident? Agree who contacts the school, how quickly information will be shared and who coordinates the response. Check legal notification obligations with your adviser.
4. Where is data stored or transferred? Understand locations and subcontractors; assess applicable restrictions with legal counsel rather than assuming every overseas transfer is prohibited.

Ask what happens when the relationship changes

1. How do you help us respond to a parent request? Discuss how relevant records can be found, corrected or handled when a preference changes.
2. How do we retrieve our information? Request a usable export and a reasonable exit process before committing.
3. When are copies deleted or retained? Ask about backups, staff devices and subcontractors as well as the main system. Document any lawful retention requirements.

Put the answers to work

Record the answers, assign an owner and make the agreed responsibilities part of the contract. The school's and the vendor's roles depend on who determines the purpose and means of processing, not simply on the label in a sales pitch. Review higher-risk uses with your legal adviser.

LIT can help schools assess their wider privacy readiness with relevant partners and discuss how MediaGuard supports media workflows. Product scope and integrations should be confirmed for your school's actual setup.

Continue with our school vendor governance guide and step-by-step school data audit.

Sources and timing checked 29 October 2026: DPDP Act, especially sections 2 and 8; commencement notification; DPDP Rules, 2025. Questions are suggested practices, not a representation that each is independently required by law.