What should parents see in a school platform?

What should a parent see by default?

Open the parts of the record a parent needs to act on this week, and nothing beyond their own child. Everything else in a parent portal is a decision the Malaysian school makes on purpose, not a setting left as the vendor shipped it.

So sort the record field by field into three buckets: open to parents, released by a named decision, or kept internal. Then put the sorting to the vendor as a test: can the parent portal carry it field by field, or does it only switch parent access on and off? The school role map sets out the other roles the same way.

What a parent view usually has to cover

• Timetable and attendance
• Work set, due dates and what is missing
• Results the school has released
• Fees and payment status
• Calendar, events and consent forms
• Messages to and from the school
• Emergency and medical details the school holds

Settle the two-children case too: whether one login switches between them, and whether a guardian linked to one of them sees only that one. The Personal Data Protection Department's security principle is the backdrop, that an organisation should “take steps to ensure that the data is secure, not modified, misused or given to unauthorized parties”.

Sorted your list? email your list to Easy Edu and ask what it can show today and what is still being built, or start with the platform evaluation guide.

Should parents see results and teacher notes?

Release results on the school's own timetable, through the report the school already stands behind, and keep teacher working notes out of the parent view altogether. A working note is written to be revised, so the school decides which version a parent reads: the draft, or the comment the school is ready to stand behind.

Google Classroom's published behaviour is a useful reference point for the results half. Google states of its guardian email summaries: “Email summaries and preview capabilities within Classroom do not include grades. For grades, ask your student or contact the teacher.” What the summary carries is narrower: “Missing work”, work “not turned in when the summary was sent”; “Upcoming work”, due “today and tomorrow” for daily emails; and “Class activities”, the “Announcements, assignments, and questions recently posted by teachers”.

A summary built around what is missing and what is coming gives a parent something to act on tonight. A school that wants more should say which results, released by whom, and after what check, then ask the vendor to show that arrangement. Testing who sees what, role by role, is covered in the role access guide.

If Malaysia's Personal Data Protection Act applies, what does it settle about a parent's access?

Where the Act applies it settles two things: who may ask, and what they may ask for. For a data subject “who is below the age of eighteen years” the Act's “relevant person” is “the parent, guardian or person who has parental responsibility for the data subject”, and that person may ask in writing for a copy of the child's data and for a correction of it.

Check the scope first, though. The Personal Data Protection Act 2010 (Act 709) is “An Act to regulate the processing of personal data in commercial transactions”, and section 3(1) states: “This Act shall not apply to the Federal Government and State Governments.” A school settles with its own adviser whether and how the Act reaches its own processing.

Where it does apply, the Act calls that person a “requestor”: “the data subject or the relevant person on behalf of the data subject, who has made the request”. Three provisions set the conditions. Under section 30 a requestor may, “upon payment of a prescribed fee, make a data access request in writing” and “have communicated to him a copy of the personal data in an intelligible form”. Section 31(1) sets the clock, subject to the Act's exceptions: the holder “shall comply with a data access request under section 30 not later than twenty-one days from the date of receipt”. Section 34 covers correction where data is “inaccurate, incomplete, misleading or not up-to-date”.

A parent login is a convenience the school designs; a written request is a separate route with its own conditions and its own deadline. So ask the vendor both questions: what the parent screen shows, and how the school would produce an intelligible copy of one child's record within three weeks, subject to the Act's exceptions. Section 32 also lets a request be refused where the holder is not supplied with the information it reasonably requires to satisfy itself “that the requestor is the relevant person in relation to the data subject”: an identity question, not a screen question.

The wording above is quoted from the 2022 reprint of Act 709 published by the Personal Data Protection Department; its current guidance says “Data Controller” where that reprint says “data user”, and cites “Section 12A” on the Data Protection Officer from “1 June 2025”, so check the current text. The privacy questions for a first meeting cover the controller and processor side; the terms are in the glossary.

How do you test the parent view in a demo?

Ask to be logged in as the parent of one named test child, then run the five checks below on that account. A demo that only shows the administrator's screen proves nothing about what a parent sees, and a slide of a parent app proves less again: that is what the concept screen or real feature guide is about.

1. 01

   Sit in the parent account yourself, on a phone as well as a laptop, and ask what each field is pulled from.

2. 02

   Ask the vendor to try reaching another child from that test account, in front of you: another child's number typed into the web address, a shared class list, a results table carrying other names.

3. 03

   Ask who may link a guardian to a child, and watch it done. Google Classroom's model is an invitation: “A teacher or admin sends an invitation to a guardian”, and “You have 120 days to accept an invitation before it expires.”

4. 04

   Ask how access ends, and watch that too. Unlink a guardian, then confirm from the parent side that the view and any emailed summaries stop.

5. 05

   Send one notification to that test parent. Check what the email or phone alert itself reveals, who can trigger it, and how a parent turns it off without losing access.

These five run alongside the general demo questions; write the answers down on the day, with the name of whoever gave them.

What should the school write down before go-live?

Write down five decisions, not the feature list: which fields sit in which bucket, who releases results and pastoral entries, who may link or unlink a guardian, who answers a written request for a copy, and where a correction is made. That register lets a new teacher, a new administrator or a new vendor pick up the same arrangement in a year.

The field list

Every part of the record, in its bucket, with the date agreed.

Who releases what

The role that releases a result or a pastoral entry, and the check before it goes out.

Linking and unlinking

Who links a guardian to a child, on what evidence, and who removes the link.

Written requests

Who answers a request for a copy, and who answers a request to correct it.

Corrections

Where a corrected record is changed, so a parent and a teacher are not left reading two versions.

The Personal Data Protection Department's data integrity principle is why the last line is there: that “each personal data is ensured to be accurate, complete, not confusing and up-to-date in accordance with the purpose for which the data is stored and processed”. Keep the register beside the data ownership and deletion questions and the wider data governance questions.