Every school holds records that would do real harm in the wrong hands: counselling notes, disciplinary proceedings, safeguarding reports, medical instructions, a note that a household could not pay fees this term. They are rarely what a school has in mind when it reviews data security, and they decide whether a family trusts the school.
Most schools can say who has a login. Far fewer can say who opened a counselling note last month, why, and whether anyone has checked since. An access review closes that gap: a short, dated exercise that answers who can see what, why, and what evidence exists.
Sensitivity belongs to the record, not the department
Confidentiality is often treated as a property of a room or a cabinet. In a digital system there are no rooms: what matters is what each record contains.
Routine records are what a school runs on: attendance, timetable, transport assignments, fee receipts, published results. They still need scoping, since a teacher does not need the whole school’s attendance, but their default is broad access for the people doing the work.
Restricted records carry a judgement about a student: repeated absence, a fee concession, a behaviour incident, a letter to a parent about a concern. They are shared on a need to know basis, where the need is a task and not a job title.
Highly restricted records carry something that can follow a child: counselling and wellbeing notes, safeguarding records, medical instructions, disciplinary proceedings that have not closed. Access here should be exceptional, named, time bound and logged.
Once those tiers exist, most access arguments settle quickly. Nobody needs a counsellor’s note to teach well.
Who can see what, and why
An access review begins not with whether a person should have access, but with what task a role performs. Four questions, asked role by role, produce an answer you can defend.
What decision does this role make? A teacher decides how to teach and who needs help; an accountant decides on receipts and dues.
What does that decision require? The teacher needs attendance, marks and behaviour notes for their own students, while the accountant needs fee status and never counselling notes.
What is the least access that still works? Read only where the role only reads, class scope rather than whole school scope, and sensitive categories hidden by default with an exception route.
Who approved it, and until when? Every exception should carry a name, a reason and an end date. Our guide to role-based access in schools covers roles, scope and separation of duties.
The test for any screen is simple: if the person looking at the counselling note cannot explain why they need it this morning, the access should not be there.
A four step access review you can finish this term
An access review is not an audit of the software. It is a documented conversation with the four or five people who hold sensitive access: the principal, the counsellor and the office administrator.
The review ends with a dated pack rather than a printout: the purpose test and the removals are what make the access that remains defensible.
Ask each of them what they can open today, not what they believe they can. Test that list against the purpose behind each access, remove what cannot be justified, and record the changes as dated decisions.
The output is one or two pages. Anything longer will not be repeated next term: a review that happens once is a project rather than a control.
Counselling notes need their own store
Counselling notes are the hardest case in a school: their usefulness depends on the confidentiality they are given. A student talks because they believe the conversation is contained, and a note that surfaces as a tab on the general student profile breaks that promise without anyone intending it.
In practice the notes live in a separate store with their own access list. The author and the counselling lead hold it by default; everyone else reaches it through a named exception that records the purpose. Where a safeguarding concern genuinely requires the principal to know, that should be a recorded decision, not a side effect of an old permission.
Write each note so it survives being read by someone else: what was observed, what was decided, who was informed. Opinion written as fact reads very differently out of context.
A counselling note belongs to this room, and the record has to be as contained in the system as the conversation was in person.
Disciplinary records should close, not accumulate
A disciplinary file records that a process ran fairly, and reminds the school what has already been tried. Neither requires keeping every remark about a student.
It should record what happened, who investigated, what the student and guardian were told, what was decided, and who reviewed the outcome. It should also carry a closure line: the date the matter was treated as finished and the point at which the file is next reviewed. Access belongs to the disciplinary or pastoral panel, not to every teacher who teaches the student.
A behaviour system and a disciplinary file have to stay distinct: a school should be able to track low level patterns in order to support a student, without that log becoming a disciplinary history; our guide to building a positive behaviour tracking process sets out where that line sits.
What the framework expects, and when
Current as of 17 October 2026, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, notified as G.S.R. 846(E) dated 13 November 2025, give the access review a legal edge.
Section 8(7) requires personal data to be erased once consent is withdrawn or the purpose is no longer served, unless retention is necessary for compliance with a law in force. Section 12 gives a person the right to correction and erasure of data processed on consent.
Rule 6 of the 2025 Rules reads almost as a description of an access review. It requires measures to control access to the systems holding personal data (Rule 6(1)(b)), visibility over who accesses that data through logs, monitoring and review so unauthorised access can be detected and prevented from recurring (Rule 6(1)(c)), and retention of those logs and the personal data for one year (Rule 6(1)(e)). Under Rule 1(4), Rule 6 comes into force eighteen months after publication, so plan for the middle of 2027.
One caution. Rule 12 read with the Fourth Schedule does not exempt an educational institution from the child data provisions generally: it covers tracking and behavioural monitoring for the institution’s own educational activities or the safety of children enrolled with it. Section 9(2) still prohibits processing likely to cause a detrimental effect on a child’s well-being.
How to prove what you decided
A review nobody is shown is indistinguishable from one that never happened. Four artefacts are enough: the reviewed list with a date on it, the decisions and the access removed, the exception register with an owner and an expiry, and the access logs themselves, kept for at least the year Rule 6(1)(e) sets.
Keep all four where a new principal or counsellor will find them: whoever ran the review usually changes role within a few years, and the evidence is what survives.
An access review checklist
- Sort every sensitive record into routine, restricted or highly restricted.
- List who can open each class of record today, role by role.
- Name the task behind each access, and remove the ones with none.
- Give counselling and safeguarding records their own store and an exception route.
- Give every exception an owner, a written reason and an end date.
- Separate behaviour tracking from disciplinary files.
- Put a closure rule on every disciplinary matter.
- Keep the reviewed list, the decisions and the access logs as one dated pack.
- Repeat once a term, and again after any change of staff.
A parent who asks who has seen their child’s file can be answered honestly, from a record written before the question was asked. Scholva keeps student records, behaviour notes and disciplinary matters in one system with role scoped access and an access history, so a review runs against the system rather than memory. Request a demonstration to see how that works for your school.
Related reading: Role-based access protects school data and What happens to your child’s data in school apps.