Student data and acceptable use policy

Adapt this template. It is not an ADEK policy, and completing it does not by itself meet a regulatory requirement. Replace every placeholder in brackets and keep a version date.

Purpose

Systems at [School name] stay available, and personal data is seen only by people who need it for their job.

Rules

• Staff accounts are personal. Shared logins for student records are closed.
• Access is removed on the last working day.
• Student photos and contact lists are not exported to private phones or messaging groups.
• Backups are tested, not only scheduled.
• A lost device or suspected leak is reported to [role] the same day.
• This policy does not authorise anyone to collect parent contacts from public datasets for marketing.

Confirm retention periods and breach duties against current UAE personal-data guidance. This template is not a legal opinion.