Guide / School data questions
School software data export and governance questions
Before choosing school software, get written answers specific to the service on six things: where each kind of data flows, who controls and processes each activity, who can open records and how that is logged, how long each record is kept, how a full export and deletion work, and what happens in an incident. Test the export with non-sensitive sample data. Ask Easy Edu and any other vendor for the same written evidence.
Published 14 September 2026 · Reviewed 14 October 2026 · EASY EDU SDN BHD
On this page9 sections
What are the key points of this guide?
- Map collection, transfer, storage, use, sharing, archive and deletion for each kind of school information.
- Name the school, the vendor and every subcontractor against each processing purpose.
- Test a sample export for fields, identifiers, attachments, timestamps and a usable format.
- Ask what happens to live data, backups and logs after exit, and how deletion is evidenced.
EASY EDU SDN BHD, part of ES PRODUCATION GROUPS BERHAD, publishes this vendor-neutral guide. Easy Edu has not yet published its hosting, retention or export arrangements, so ask it the same questions as any vendor.
This is the main data guide. For contract ownership wording, export tests and deletion evidence in more depth, see the school data ownership, export and deletion questions.
Vendor-neutral guide
How should a school draw the complete data flow?
Draw one diagram per kind of information (attendance, results, messages, contact details) and follow it through seven stages. Include backups, analytics and vendor support access, because those paths run outside the screens a demonstration shows. Ask the vendor to confirm the diagram in writing and date the version.
| Stage | Question for the vendor |
|---|---|
| Collection | Which fields are collected, from whom, and which are optional? |
| Transfer | How does data enter the service: typed in, imported, or synchronised from another system? |
| Storage | In which systems and locations is it held, including backups? |
| Use | For which purposes is it processed, including analytics? |
| Sharing | Which other parties or systems receive it? |
| Archive | When does it leave the live system, and who can still open it? |
| Deletion | What removes it, and what evidence confirms that? |
Why collection deserves a column of its own: UNESCO's 2023 Global Education Monitoring Report cites one pandemic-era analysis in which 89% of 163 education-technology products could survey children.
Who controls and processes each school-data activity?
For every processing activity, name each party, its purpose and its authority. Malaysia's Personal Data Protection Department FAQ explains the general concepts, but the actual legal role depends on the arrangement, so request the current contract and take advice. A vendor’s stated privacy value, Easy Edu’s included, is a direction, not a control.
Easy Edu’s guide to the privacy questions to put in a first vendor meeting turns the same split into one question per principle.
| Party | Processing purpose | Decision authority | Handles family requests? |
|---|---|---|---|
| School | Why each record is collected and used | Sets purposes, access and retention | Who receives access and correction requests |
| Vendor | What it does with school data, and on whose instruction | Which decisions it may make alone | How it passes requests to the school |
| Each subcontractor | Hosting, support, messaging or analytics | What the contract allows it to do | Whether it ever sees a request |
The contract carries much of the weight: UNESCO's 2023 Global Education Monitoring Report finds only 16% of countries explicitly guarantee data privacy in education by law.
How should access and auditability be tested?
The aim is accountability: knowing who opened or changed a record, not assuming a control exists because a dashboard looks tidy. Ask for evidence on each line below, including vendor support and emergency access. For the full permission matrix by role, use the guide to evaluating teacher, student, parent and administrator access.
- Authentication
- Sign-in method, and how account recovery is checked.
- Privilege review
- Who grants administrator rights, and how often the list is reviewed.
- Activity log
- Which actions are logged, how long logs are kept, and who can read them.
- Support access
- Who at the vendor can open school records, and how that is logged.
- Leavers
- How a departed user is removed, and within what time.
What belongs in a school-data retention schedule?
Settle retention before migration: removing information later is harder than deciding what the service should receive in the first place. Do not accept “forever” or “as needed” without an operational explanation, and confirm whether the school can set different periods for different records. Each record category needs these five fields:
- Purpose
- Why the school keeps this record at all.
- Active period
- How long it stays in the live system after the event that created it.
- Archive and backup
- How long copies persist after removal from the live system.
- Deletion trigger
- The event that starts deletion, such as student departure, account closure or contract end.
- Owner
- The school role that approves exceptions to the schedule.
How should a school test data export and deletion?
A contractual right to export matters most when the school has already checked that the exported data is usable. Run the test before signing, with demonstration data only. This is the short test; the data ownership, export and deletion guide sets the written terms to check it against.
- 01Agree the sample: which records, attachments and history it should contain.
- 02An authorised administrator runs the export as the school would.
- 03Compare counts, identifiers, relationships, attachments and timestamps with the source.
- 04Open the files with tools the school already uses.
- 05Note the time taken, any cost and who is responsible for a full export.
- 06Ask what evidence confirms deletion from live data, backups and logs.
Which evidence should an incident-response review request?
Ask for the vendor's written procedure, then rehearse it with a short tabletop scenario to see which information each side receives and who decides on containment and on telling families. Keep emergency phone numbers in the school's controlled records, not on a public page. Bring anything left open into a self-run school platform evaluation session.
| Stage | Evidence to request |
|---|---|
| Detection | How incidents are noticed, and who at the school is told first |
| Contacts | A named incident contact on each side, and the first-notice timeline |
| Containment | Who decides what is switched off or restricted, and how fast |
| Communication | What the school receives, and who tells families |
| Review | The written report after the event, and who signs it off |
Quick answers
What do schools ask about software data export and governance?
What should a school-data flow include?
Each kind of information, where it is collected, how it is transferred, where it is stored, how it is used and shared, and how it is archived, exported and deleted. Name who can open each stage and who decides its purpose, and ask the vendor to date the diagram.
How should school software data export be tested?
Use non-sensitive demonstration data and check fields, identifiers, relationships, attachments, timestamps and format against the source. Note the time, cost and person responsible for a full export, and ask separately how live data, backups and logs are deleted.
Does this page confirm Easy Edu's data controls?
No. Easy Edu has not yet published a data-flow diagram, hosting arrangement, retention schedule, export method, deletion process or incident procedure. Each question stays open until current documentation is supplied.
External context
Which outside sources does this guide cite?
- UNESCO: 2023 Global Education Monitoring Report
- Personal Data Protection Department, Malaysia: frequently asked questions
Method and scope. A vendor-neutral checklist built from the public sources listed above. They do not describe or endorse Easy Edu.
Next move
How do the questions become a review agenda?
Give each open question an owner and a date, then work through the vendor's answers together in one session.
EVERYTHING ON THIS SITE
Every EASY EDU guide and page
- About EASY EDU SDN BHD
- Contact Easy Edu
- Easy Edu FAQ: company, product status and platform evaluation
- School platform evaluation glossary
- School platform evaluation guides
- Privacy notice for easyedu.com.my
- How to run a school platform evaluation session
- How to evaluate a school platform before you buy
- School role map: who sees, changes and approves each record
- Questions to ask in a school platform demo
- Reduce duplicate school record entry
- A school software onboarding checklist
- Integrated school platform or separate apps?
- How to evaluate teacher, student, parent and administrator access
- School data ownership, export and deletion questions
- School platform privacy questions for a first vendor meeting
- Concept screen or real feature in a school demo?