New Yorkers United for Kids

How to trace student data through your school portal

A school’s parent portal can reveal far more than attendance and report marks. Depending on the platform and the state or territory system behind it, families may see behaviour records, health notes, learning adjustments, assessment results, contact details, permission settings and messages linked to a child’s profile.

For Australian parents, the first step is to use your school’s parent portal to identify exactly which student data is being collected, displayed and shared. The screen is only the visible layer, however. Some information may sit in a separate administration system, a testing database or a third-party education app.

This matters in Sydney, Melbourne, Brisbane and regional communities alike. Schools may use platforms such as Compass, Sentral, SEQTA, Schoolbox or state-managed systems, while NAPLAN, attendance reporting and learning support records can follow different privacy and access rules.

A careful portal review helps parents move from general concern to specific evidence. It can also support a constructive conversation with a principal, school council, P&C association or department privacy officer about data minimisation, retention and consent.

Start with the profile and permissions

Log in from a secure device and inspect every menu attached to your child’s account. Check the student profile, emergency contacts, medical information, attendance history, academic reports, wellbeing notes, excursions and payment records. Take dated screenshots only where permitted, and avoid storing sensitive information in an unsecured cloud folder.

Look for labels such as “visible to staff”, “shared with providers”, “learning support”, “welfare” or “integrations”. A portal may show only a summary while the school retains more detailed case notes. In Victoria, for example, families may interact with a school platform alongside department systems, so the portal should not be treated as a complete register of every record.

Pay attention to your own account as well. The school may hold your mobile number, email address, occupation, language preference, custody information, communication preferences and payment history. Check whether another parent or carer has access and whether old contact details remain active.

Separate educational records from technical data

Student information is not limited to written records. A platform can generate login times, device details, IP addresses, browser information, location estimates, uploaded files and audit logs. An integrated reading, mathematics or behaviour app may also collect activity data that never appears in the main parent dashboard.

Read the platform’s privacy notice, acceptable-use policy and terms for connected services. Identify the school, department, software provider and any other organisation acting as a data custodian. Australian Privacy Principles may apply, but public schools and education departments can have additional state or territory policies governing access, disclosure and retention.

Make a simple record of each category: what is collected, why it is needed, who can view it, how long it is kept and whether it is sent offshore. In the Australian market, vendors may host information in Australia, New Zealand or other jurisdictions, and the answer can differ between a government portal and a commercial tutoring application.

Compare the portal with assessments and reporting

Match what you see against reports for NAPLAN, school-based testing, attendance, literacy and numeracy screening, and learning support. A result may be displayed as a score, proficiency band, teacher comment or progress marker, while the underlying answer data is held elsewhere.

Check whether assessment information is linked to a student identifier, year level, class, disability adjustment, English-language background or wellbeing record. These combinations can create a detailed profile even when each individual field appears routine. Parents in NSW and Queensland may encounter different terminology and retention rules, so use the relevant department’s privacy guidance rather than relying on advice from another state.

If a school uses an external testing or learning platform, ask whether the account is created automatically, whether participation is compulsory and how deletion works when a child changes schools. A clear record of these questions can support broader advocacy around student testing and informed consent. Resources on student testing rights can help frame that discussion.

Build a focused data audit

Begin with a short inventory rather than a broad request. Record the portal name, the date checked and the visible categories. Then identify gaps, especially where a heading suggests that records exist but the contents are hidden from families.

Useful evidence to capture includes:

Next, send the school a polite written request for clarification. Ask which systems contain your child’s information, the purpose of each category, the authorised users, retention periods, overseas disclosures and the process for correcting inaccurate records.

When reviewing the response, separate answers from assumptions. Keep copies of policies and note the staff member responsible for privacy matters. If information is missing, use the department’s formal access or correction process rather than repeatedly searching the portal.

Turn findings into practical action

A parent portal audit is most useful when it produces a small number of precise issues. An unexplained “wellbeing” category, an old medical alert or an unknown app integration deserves attention before a general debate about technology in schools.

For a meeting with the principal, school council or P&C group, prepare:

Keep the tone factual and focus on proportional collection. Schools need reliable information to support children, manage safety and meet reporting obligations, but families should be able to understand the purpose and boundaries of that collection.

The portal is a useful starting point, not the whole record. What matters most is tracing each data field from collection to access, sharing and deletion, then keeping a written account of what the school confirms.

✉