Browse the full library
Return to the complete guide collection and navigate the wider MONTI educator ecosystem.
Guide 03 · Privacy & Governance
Data Privacy & FERPA-Aligned Practices for Micro-Schools
Map your data flows, safeguard student information, and align your micro-school's AI and admissions systems with privacy best practices.
Use this guide
What this helps you build
This guide helps you create a clearer privacy operating model for a micro-school by identifying data flows, access levels, vendor risks, and incident response expectations before systems scale messily.
Map data clearly
See what student, family, and staff data you collect and where it moves.
See what student, family, and staff data you collect and where it moves.
Reduce risk
Review access, vendors, AI tools, and consent practices before problems emerge.
Review access, vendors, AI tools, and consent practices before problems emerge.
Build trust
Create workflows that protect children, reassure families, and support responsible school growth.
Create workflows that protect children, reassure families, and support responsible school growth.
01
Step 1
Map your data flows
Identify what data you collect, from whom, where it travels, and where it is stored.
Map your data flows
Identify what data you collect, from whom, where it travels, and where it is stored.
Start with visibility. Privacy problems often begin because no one has mapped the full system.
Student data sources
Family and guardian data sources
Staff and contractor data sources
Systems that hold data
02
Step 2
Classify data sensitivity
Group data by sensitivity and define which roles should access each level.
Classify data sensitivity
Group data by sensitivity and define which roles should access each level.
Not all school data carries the same risk. Classification helps you set proportionate safeguards.
Basic data
Sensitive data
Highly sensitive data
Access rules
03
Step 3
Design consent and transparency
Clarify how you explain data use to families and how meaningful consent is obtained.
Design consent and transparency
Clarify how you explain data use to families and how meaningful consent is obtained.
Families should understand what you collect, why you collect it, and where AI enters the workflow.
Plain-language privacy statement
AI use explanation
Consent workflow
04
Step 4
Review vendors and AI tools
List each tool that handles school data and assess its privacy posture before trust is assumed.
Review vendors and AI tools
List each tool that handles school data and assess its privacy posture before trust is assumed.
Every tool introduces a data relationship. Review what each one receives, stores, shares, and retains.
Tools and vendors
Due diligence notes
Risk level and actions
05
Step 5
Define access controls and logs
Set rules for who can see what, how access is protected, and how changes are reviewed.
Define access controls and logs
Set rules for who can see what, how access is protected, and how changes are reviewed.
Good privacy practice is operational. Permissions, authentication, and audit habits matter more than policy language alone.
Roles and permissions
Authentication and security measures
Access logs and audits
06
Step 6
Draft your incident response plan
Prepare in advance for what you will do if there is a data issue, exposure, or suspected breach.
Draft your incident response plan
Prepare in advance for what you will do if there is a data issue, exposure, or suspected breach.
Response speed improves when reporting lines and first actions are already defined.
Detection and reporting
Containment and investigation
Notification and communication
Remediation and learning
07
Step 7
Connect to AI, admissions, and your operating system
Tie privacy decisions into your broader lesson planning, marketing, admissions, and school systems.
Connect to AI, admissions, and your operating system
Tie privacy decisions into your broader lesson planning, marketing, admissions, and school systems.
Privacy becomes real when it shapes day-to-day decisions across admissions, communication, and instruction.
Links to other systems
Hub link or policy reference
Next actions in the next 30 days
Implementation snapshot
A practical privacy operating model
Map what data enters your school, classify its sensitivity, review the tools that touch it, restrict access intentionally, and connect every privacy decision to how your school actually runs.