Privacy 4 min read Updated October 2026
Who sees what: designing permissions
In an educational institution information is sensitive by definition. Permissions that are too broad harm the student’s dignity and privacy. Permissions that are too narrow silence information that needs to reach the people providing care. This guide offers a model that balances both, and shows how to keep it that way over time.
1. Permission comes from the role, not the person
When permission is tied to a role rather than a person, a change of roles doesn’t leave unnecessary access behind or block work. It’s also what lets you answer clearly: who was allowed to see what, and when.
| Role | What they need to see, for example |
|---|
| Counselor | Their own group: attendance, exits, notes and their students’ files. |
| Head of boarding | All groups in the boarding house, reports and incidents. |
| Learning center or clubs coordinator | Placement, timetable and lesson attendance, not the whole file. |
| Guard | At the gate only: name, photo and a valid exit approval. |
| Care team | Therapeutic information about the students in their care. |
| Management | An overview and reports, as needed. |
The table is a starting point. Each institution adapts it to its own structure and policy.
2. The least needed to do the job
The principle behind the whole table: everyone sees what they need for their daily work, and no more. A counselor doesn’t need access to the whole institution. A guard doesn’t need to read a file. A clubs coordinator doesn’t need a student’s medical information to place them in basketball.
When unsure whether to grant access, the question isn’t “would it hurt?” but “do they need it to do the job?”.
3. Therapeutic information is separate from operational information
Therapeutic, emotional or medical information doesn’t belong in the same layer as attendance reports. Separating the layers lets you share what operations need without exposing what belongs to the care team.
What separation looks like in practice
- The counselor knows a student needs medication at a certain time, without seeing the whole medical history.
- The staff know a student is in therapy, without reading the therapy summaries.
- What operational staff need to know is written as a practical instruction, not as part of the therapeutic document.
4. What doesn’t go into the system
Not everything needs to be written down. A personal conversation, a family detail or a staff member’s guess isn’t a system record. The practical rule: write what’s needed for continued care, in language you could show the student and their parents.
5. Staff changes: the same day
Most permission problems aren’t created on the day access is granted, but on the day someone forgets to change it: an employee who left and still has access, a counselor who moved groups and still sees the old one.
01New employeePermissions by role and group, before the first shift.
02Change of group or roleOld permissions close and new ones open on the same day.
03Long absenceDepending on institution policy, access can be paused until return.
04LeavingAccess closes on the last working day, not at the end of the month.
6. Access logs and periodic review
Logging actions and views isn’t suspicion of the staff. It’s what lets you answer a question, spot misuse, and protect staff members themselves when a claim is raised.
A quarterly review
- The list of all active users: do they all still work here?
- Do each person’s permissions fit their current role?
- Does anyone see therapeutic information without need?
- Are privacy procedures up to date, and does the staff know them?
Common mistakes
- Broad permissions for everyone “for now”.
- Permissions tied to a person instead of a role.
- Medical information in a general note the whole staff can see.
- Former employees who can still log in.
- Sharing information about a student in the staff WhatsApp group.
Want to build a permission model that fits your structure? In one session we’ll go through the roles and what each one needs to see.
