School platform contract checklist before signing

Which contract terms should a school check before signing?

Check six core terms before signing: the length and renewal of the contract, what the quoted price includes, the availability the vendor commits to, how long backups are kept, the data processing terms, and what happens to the school's records at the end. Ask for each answer in writing, and check that the signed document says the same thing as the proposal.

A promise made in a demonstration is not a contract term until it is written into the contract. The UK Department for Education's Procuring educational technology (EdTech) guidance tells schools: “Before signing any contracts or agreements with the supplier, check all clauses to ensure they meet your requirements and challenge any that you are unhappy with.” Telling a concept screen from a released feature comes first; the demo questions are where most of these promises are made.

Comparing vendors? You can email the six questions to every vendor on your shortlist, Easy Edu included, and compare the written answers side by side.

How long does the contract run, and does it auto-renew?

Find three dates before signing: when the contract starts, when it ends, and the last day the school can give notice if it does not want to renew. Then ask whether the contract renews by itself, for how long, and whether the price on renewal is fixed, capped or open. Record all of it in one place the school will look at before that notice date.

The renewal clause decides what the school pays after the evaluation is over, so read it as closely as the first-year price. The Department for Education's digital leadership and governance standard asks schools to keep a contracts register covering licences, subscriptions and technology contracts, so that they know what they hold “and when they need to be reviewed”. Without these registers, it warns of “budget pressures due to accidental renewal of subscriptions, software and hardware that might not be needed, or are not the best value for money”.

Give the register an owner. The governance standard asks a member of the senior leadership team to be responsible for digital technology, with the business or finance team keeping the commercial details up to date. Put the notice date in that senior leader's calendar the day the contract is signed.

What exactly does the quoted price cover?

Ask for a written list of what the quoted price includes and what is billed separately. The usual items to check are the licences and how they are counted, set-up, moving the school's existing records in, training, support during term time, and any add-on modules shown in the demonstration. Anything not on the list should be treated as extra until the vendor says otherwise in writing.

A school should ask how licences are counted: per student, per staff account, per campus, or as one site licence, and what happens when enrolment changes in the middle of a contract. Ask too what the school is expected to do itself, because staff time is part of the cost.

Keep the itemised list with the contract in the school's contracts register. The Department for Education's governance standard says the registers help a school “keep track of buying and licensing so that schools or colleges can get better value for money when renewing software and hardware”. How a records import is priced has its own questions in the guide to moving school records into a new platform.

What uptime figure should a school platform's SLA promise?

There is no single right figure, so ask the vendor for its availability percentage in the service level agreement (SLA), convert it into hours of downtime a month, and judge that against the school day. Ask which hours the figure covers, whether planned maintenance counts as downtime, how the school is told, what it receives if the figure is missed, and how fast support responds in term.

Small differences in the percentage are large differences in the timetable. The Department for Education's cloud solutions standard says “Availability targets provided by cloud suppliers may appear misleading.” and gives the conversion:

Swipe sideways to see every column

The cloud solutions standard also tells schools: “You should trial the cloud solutions before committing to buy to make sure performance meets expectations.” A trial is where a school sees whether the platform holds up on its own network at the busiest hour; the pilot guide sets one up.

How long does the vendor keep the school's backups?

Ask how long backups are kept, how far back a restore can go, who in the school can ask for one, and how quickly it is done. Then compare the answer with the records the school cannot afford to lose, such as marks, attendance and fee balances, and decide whether the school also needs its own regular export.

A backup the vendor deleted last month cannot be restored this month. The cloud solutions standard notes that “The most common risk of cloud data loss is accidental or deliberate data deletion by users.” and that “Cloud providers will only hold backup data for a limited period. This could be for as little as 30 days with some providers. This will depend on your service level agreement.”

So the backup period belongs in the SLA, not in a support article that can change. If the period is short, ask whether the school can schedule its own export in a format it can open without the platform.

What must the data processing agreement say?

The data processing agreement, or the processing clauses in the contract, should say that the vendor handles the school's records only on the school's documented instructions, keeps them confidential and secure, uses sub-processors only on agreed terms, helps the school answer requests, returns or deletes the records at the end, and allows audits. Ask for it signed with the contract.

The UK regulator's list makes a useful checklist even outside the UK. The Information Commissioner's Office explains that Article 28(3) of the UK GDPR sets eight minimum terms for such a contract:

• processing only on the controller's documented instructions;
• a duty of confidence;
• appropriate security measures;
• rules on using sub-processors;
• help with data subjects' rights;
• assisting the controller;
• end-of-contract provisions;
• audits and inspections.

That guidance explains UK law, not Malaysian law, and the ICO notes it is under review after the Data (Use and Access) Act. Where Malaysia's Personal Data Protection Act 2010 (Act 709) applies, the 2022 reprint's section 9(2) requires the data user to ensure that a data processor acting on its behalf “provides sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out”. The reprint regulates personal data “in commercial transactions” and its section 3(1) says “This Act shall not apply to the Federal Government and State Governments”. Whether and how it reaches a given school is a question for the school's adviser; the questions to put to a vendor are in the PDPA privacy guide, and the terms themselves are in the glossary.

What happens to the school's records when the contract ends?

The contract should say how the school's records come back, in what format, by what date, and how the vendor will confirm that its remaining copies, backups and archives included, have been deleted. Agree it before signing, while the school still has a choice of vendor, rather than at the end.

An export the school cannot open without the old platform is not an exit. The cloud solutions standard asks for “a timely process for data transfer in an open standard or neutral format if you end the contract”. How to test an export and the deletion before signing is in the data ownership, export and deletion guide.

Which other clauses change the risk: termination, liability, ownership and law?

Beyond the six core terms, read five more clauses before signing: when the school can end the contract early, how much the vendor is liable for if something goes wrong, who owns the material the school uploads, which country's law and courts govern the contract, and who in the school may sign. Each can change what the school is committed to.

• Early termination. Can the school leave if the availability figure is missed repeatedly, or the data terms are breached, and what notice and fees apply?
• Liability and indemnities. Is the vendor's liability capped, at what level, and does the cap cover a data breach?
• Ownership of content. Do lesson materials, reports and records the school creates stay the school's, during the contract and after it?
• Governing law. Which country's law applies, and where would a dispute be heard? A Malaysian school signing a vendor's overseas template should ask early.
• Authority to sign. Who in the school may commit it to a multi-year agreement, and does the board or bursar need to approve it first?

These are questions for the school to ask, not a statement of what any contract must contain. The full evaluation sequence, from first demonstration to signing, is in the guide to evaluating a school platform.