The invisible problem
Permissions are a neglected topic in most schools – until something goes wrong. Then it turns out that almost everyone has access to almost everything. Or nobody can edit anything because permissions were never set. Or a former colleague still has access to sensitive data.
Permissions and roles are not a purely technical question. They are an organisational decision: who should be allowed to see and edit what?
What happens without clear structures
- Security gaps: personnel files, student records or test results are accessible to people who have no need for them.
- Data protection risks: GDPR violations often arise not from bad intent but from unmaintained permissions.
- Uncontrolled access: if everyone can edit everything, there is no reliable data quality and no audit trail.
- Difficult maintenance: individual permissions for each person are almost impossible to keep track of – especially when staff change.
Roles instead of individual permissions
The solution is role-based access control (RBAC): instead of giving each person individual rights, roles are defined (e.g. "form teacher", "administration", "school leadership", "subject teacher"). Each role receives exactly the permissions needed for its tasks. People are assigned to one or more roles.
Benefit: when someone leaves or changes role, a single change is enough – instead of reviewing dozens of individual permissions.
The least privilege principle
A core principle of IT security: every person receives only as many rights as strictly necessary for their tasks. "Everyone has access to everything because it is more convenient" is not an acceptable solution – neither legally nor from a security perspective.
In practice this means: permissions are granted sparingly and reviewed regularly.
Where to start
A pragmatic starting point:
- Create a list of the digital systems and file areas the school uses.
- For each area, clarify: who needs read access? Who needs write access? Who should have admin rights?
- Group people into roles (form teacher, administration, …).
- Set permissions at role level, not person level.
- Define an offboarding process: what happens when someone leaves the school?
Key takeaway
Permissions are not a one-time setup – they are an ongoing process. Define them cleanly once, review them regularly, and you will have significantly less risk – and significantly less effort when staff change.