Vendor Risk: Mapping Every Vendor That Touches Student Data

The first thing to settle in vendor risk: mapping every vendor that touches student data is the identity of the student data retained by a vendor and the reason it is retained, since every later issue about permission, exception or contract depends on those two facts. Where the file is unclear, the rest of the analysis wobbles with it; where the file is clear, the determination usually follows without drama.

When security and confidentiality requirements appear to conflict, the conflict ought to be escalated and documented, not resolved by ignoring one side.

Event detection is a confidentiality control, because a breach discovered late harms more students than the same breach discovered early.

Proctoring tools collect some of the most sensitive information on campus, and their adoption needs a higher standard of review than an ordinary classroom tool.

A verbal disclosure counts the same as a written one for privacy purposes, even though it leaves a thinner trail for later review.

Student portals concentrate files in one place, which makes access control both more significant and easier to audit than scattered files.

Shared drives accumulate copies that outlive their purpose, and periodic review of shared folders is a confidentiality task, not housekeeping.

Site card systems retain transaction and location information, and their storage ought to reflect that sensitivity rather than the convenience of indefinite logs.

Survey systems hold responses that may be sensitive, and the survey design should settle anonymity, storage and reporting before distribution.

Video surveillance retains images of identifiable students, and its retention, access and disclosure requirements ought to be written before cameras are installed.

AI feedback tools may retain student work for training unless the contract says otherwise, and that term should be settled before adoption.

Settle survey protections before distribution, including anonymity, storage and reporting, because retroactive protection is rarely credible.

Hold a confidentiality committee that may actually stop a project, because a committee that only advises shall be ignored when it matters.

Plan for remote work explicitly, with safeguards that travel with the record to staff homes and personal devices.

Separate health and counseling systems from general student systems, with access limited to the staff who provide the care.

Detect events early via monitoring, because early detection limits the number of students affected.

Build opt-out into data feeds, so that an opt-out exercised in one system propagates to each system that publishes the data.

Encrypt files in transit and at rest, and treat encryption as a baseline, not as a substitute for access control or purpose limits.

Name a person to request when the answer is unclear, and welcome escalation, since punished escalation produces quiet non-adherence.

In that illustration the registrar explains the position politely, in writing, and offers the parent a route through the student's own permission.

In that illustration the college contains the affected integration, notifies affected students with clear facts, and files the event for the after-action review.

In that illustration the employer receives a prompt, limited answer, and the graduate is not surprised by a broader disclosure.

Consider a counselling service that retains notes in a personal file and is asked whether those notes are education files, and that verifies the exception before answering.

In that illustration the older logs are deleted, the new period is published, and future logs expire automatically.

Accepting a vendor's consumer privacy policy as a substitute for a contract is an error, because consumer policies describe the vendor's own practices, not the university's objectives.

Redisclosing a file received under an exception, without verifying whether the second disclosing is covered, is a mistake that spreads the original sharing.

Auditing surveillance systems only for image quality, and not for access and storage, is an error, because cameras generate files continuously.

Assuming an integration passes only the data shown on a diagram is a mistake, because integrations routinely pass more than intended.

Allowing tracking in education tools for younger students to go unchecked is a mistake, because behavioural information grows silently over a school year.