Start by describing the task and the information it really needs. A tool answering questions from published pages has a different data flow from a tool connected to individual records. That distinction belongs at the beginning of the conversation.
The U.S. Department of Education’s 2014 guidance examines privacy and security considerations for third-party online educational services used by students or parents as part of school activities. It has a defined scope and is not a substitute for checking current requirements for your institution. Read the official resource and its scope.
Ask for a concrete account of the data
- What information is collected from the institution and from each person using the service?
- Which parts are required for the task, and which are optional?
- Who can access it, including service providers?
- What are the retention and deletion arrangements?
- Is the information used to train models or for other purposes?
- What happens to it when the service ends?
Walk through one example
Ask the provider to demonstrate a realistic interaction using fictional information. Trace where that information appears, who can retrieve it, and what an administrator can control. Compare the demonstration with the written terms.
Give the review an owner
Bring the service owner, privacy lead, and technology team into the same review. Record unresolved questions and the person responsible for each. Treat a missing answer as work still to be done, rather than filling it in with an assumption.
“Can we accomplish this task with public information, or do we actually need an individual’s records?”
Sources & further reading
Sources checked September 19, 2026. The exercises and recommended next steps are The School Guru’s editorial suggestions. Check the linked authority for current requirements and institution-specific applicability.