"We deleted the file from the server." "Did you delete the backups?" "Did you delete the email attachment sent to the psychologist in 2023?"
This is the conversation keeping Data Protection Officers up at night. The "Right to be Forgotten" (Article 17 of GDPR) is complex enough in business, but in education, where data retention laws clash with privacy rights, it is a legal minefield.
Image: Cybersecurity lock concept
The "Shadow Data" Problem
Most schools have strict policies for their main MIS. But SEN departments often operate in the "shadows" to avoid clunky systems or because the main system doesn't capture the nuance they need.
They store sensitive data in:
- Excel spreadsheets on local desktops (High Risk)
- Physical folders in unlocked cabinets (High Risk)
- Email threads with external agencies (Critical Risk)
- WhatsApp groups for TAs (Severe Violation)
If a parent submits a Subject Access Request (SAR), can you confidently say you have found—and if asked, deleted—every instance of their child's data?
Centralization is Compliance
MeritDocs solves this by being the single source of truth for SEN data. We don't just store data; we govern it.
When you delete a student record in MeritDocs, our cascading delete protocols ensure it is removed from lists, reports, and search indices instantly. We provide a "Compliance Certificate" for your DPO, proving that the digital footprint has been erased in accordance with EU law.
Audit Tip: The "Downloads" Folder
Check your staff's "Downloads" folder. That CSV you exported last term to do a quick mail merge? It contains sensitive data, it's unencrypted, and it's a GDPR breach waiting to happen. MeritDocs allows you to work in the browser, removing the need for risky downloads.
Protect your students and your school. Schedule a security audit with our team.