Blog

Schools operate in uniquely complex environments. They are custodians of children’s and parents’ personal information, responsible for physical safety on dynamic campuses, accountable to parents, guardians, regulators, and oversight bodies such as school governing bodies or boards, and often reliant on a mix of staff, contractors, coaches, and volunteers.

Most schools do not set out to be non-compliant. The risk lies in blind spots – everyday practices that feel normal, helpful, or inherited – that quietly create legal, governance, and reputational exposure.

Let’s look at just seven of the most common of these blind spots, and what schools can do to mitigate them.

Informal WhatsApp and Messaging Groups

WhatsApp groups are often the operational backbone of schools. They are used for parent communication, sports co-ordination, staff discussions, and sometimes learner-related matters.

The risk arises when personal information, disciplinary issues, medical details, or sensitive incidents are shared informally, without clear rules or oversight. Messages are rarely retained systematically, access is difficult to control, and screenshots can travel far beyond the intended audience.

To mitigate this risk, schools should clearly define what may and may not be shared on informal platforms, ensure that official communication channels are used for sensitive matters, train staff and coaches on acceptable use, and document communication protocols approved by management.

Coaches, Tutors, and Third-Party Service Providers

Many schools rely on external coaches, tutors, therapists, and others who interact directly with learners and access personal information.

These individuals often fall outside of standard HR onboarding processes, which creates gaps in vetting, contracting, and accountability. The risk is not only safeguarding-related, but also includes unlawful access to personal information, lack of confidentiality undertakings, and unclear responsibility when something goes wrong.

Schools should ensure that all third parties are formally contracted, vetted appropriately, trained on school policies, and subject to clear rules regarding information access and conduct. Third-party risk should be actively managed rather than assumed away.

Excursions, Tours, and Off-Campus Activities

Excursions are a core part of the school experience, but they introduce heightened compliance risk.

Schools collect medical information, emergency contacts, consent forms, identity documents, and travel details, often in compressed timeframes and through informal processes. Information is shared with transport providers, accommodation venues, and staff, sometimes via personal devices or unsecured platforms.

Mitigation starts with standardised excursion packs, clear data collection limits, secure storage and sharing methods, defined retention periods, and clarity on who may access information and why.

Excursions should be treated as high-risk activities from an information governance perspective, not just from a safety one.

Data Retention and Historic Records

Schools are excellent record keepers; sometimes too excellent.

Old learner files, disciplinary records, assessment data, closed-circuit television (CCTV) footage, and correspondence are often retained indefinitely, without clear legal or operational justification. Excessive retention increases exposure i.e. the longer data is kept, the greater the risk of unauthorised access, breaches, or misuse.

Schools should implement clear retention schedules aligned to legal requirements, and apply them consistently. Data that no longer serves a lawful purpose should be securely disposed of. Retention decisions should be documented and defensible.

Assumed Accountability

In many schools, oversight bodies trust that management is handling compliance, and management trusts that the oversight body is comfortable. The result is often an accountability gap.

Compliance may not feature regularly on meeting agendas, risk registers may be outdated, and reporting may be informal or inconsistent. This creates risk not only for the school, but also for the individuals involved.

Oversight bodies should receive regular, structured reporting on compliance risks, incidents, and mitigation measures. Accountability should be visible, documented, and intentional. Silence is not neutral – it can be interpreted as a lack of governance.

Health Data and Duty of Care

Health information is particularly sensitive, yet schools often collect and share it widely in the name of care and safety.

Medical conditions, allergies, learning support needs, and incident reports may be accessible to more people than necessary, stored insecurely, or discussed casually.

While duty of care is critical, it must be balanced with lawful processing and confidentiality. Schools should apply strict access controls to health information, ensure that staff understand confidentiality obligations, and limit sharing to what is genuinely necessary. Care does not justify uncontrolled access.

Visitor Access and Physical Security Records

Visitors, contractors, parents, and service providers move through school campuses daily.

Visitor registers, access cards, CCTV footage, and security logs contain personal information that is often overlooked from a compliance perspective. Registers may be left unattended, CCTV footage retained indefinitely, and access permissions poorly controlled.

Schools should treat physical security data as part of their information compliance framework. Visitor records should be protected, retention periods defined, and access to footage strictly controlled and logged.

From Policy to Practice

The solution is not to eliminate practical tools or overburden staff, but rather to bring structure, clarity, and governance to how information is handled.

Schools that manage these risks well tend to do the following:

• Clearly define roles, responsibilities, and decision-making authority.
• Train staff, coaches, and contractors on real-world scenarios.
• Align policies with how the school actually operates.
• Ensure there is visible and informed oversight.
• Regularly review and update risk areas.

Compliance in a school environment must be lived, not laminated.

Governing with Clarity and Intent

Schools are trusted environments. Parents, learners, staff, and oversight bodies expect care, professionalism, and accountability. Most compliance failures in schools do not arise from malice. They arise from familiarity, habit, and assumptions.

By identifying and addressing these blind spots proactively, schools can protect learners, support staff, and strengthen trust, while meeting their legal and governance obligations.