Protecting your school data starts with asking the right questions.
Over the past month, my team has taken calls from primary schools facing serious security breaches. One had their website hacked and lost all its data. Another discovered their provider had sold ad space on their site, displaying what I would describe as inappropriate Temu ads. A third that was about to move to a secure Hail website, only to be told they couldn’t move their free website to Hail without paying a $2,300 “exit” fee – something they had no idea about.
These are 100% true stories.
I’ve worked in IT security for over 30 years, helping organisations around the world improve their security practices. And I can honestly say— I’ve never seen it this bad. The risks are growing, and the education sector is becoming an increasingly attractive target.
As a principal or board member, it’s essential to ensure that all your school’s digital services put privacy and security first. It’s not enough to rely on assumptions—whether the provider is a global tech giant, a local IT business, or just has a slick marketing website. You need to ask the right questions to check that they are putting security first.
To help, I have prepared the five key questions every school should ask its IT and software providers:
1. What personal data is collected, and why?
Vendors should be able to explain, in plain language, what data they collect—such as student or caregiver information—and exactly how it’s used.
2. Where is the data stored, and for how long?
Data should be stored securely, ideally in New Zealand or Australia, and only for as long as necessary. Make sure you know what happens to your data if you stop using the service.
3. Who can access the data?
Confirm that access is strictly limited. Ask whether third parties—such as marketing or analytics providers—can access your school’s data.
4. How is the data protected?
Ask about encryption, password policies, and other measures that protect your data against breaches and misuse.
5. Has the software been independently reviewed for privacy and security?
Look for products that meet the Safer Technologies for Schools (ST4S) standard. This is a Trans-Tasman initiative backed by the Ministry of Education, assessing digital tools used in schools for privacy, security, and responsible data handling. A product with an ST4S review has undergone a thorough, independent assessment, giving you peace of mind.
👉️ I have attached a flyer you can print and hand to your IT provider.
At Hail, we take these responsibilities seriously. We’re proud to be the only provider in Australasia to hold three ST4S certifications:
-
Hail website and newsletter: The first communications and website provider to be ST4S certified in NZ.
-
Hail AI: The first AI tool in NZ designed with privacy at its core—checking for bias, flagging inappropriate content, and preventing data retention.
-
Election Pilot: Our School Board Elections tool, approved for secure online voting – again a NZ first.
This is a huge investment we have made in technology, people and systems. But it is important.
But this issue goes beyond any one provider.
That’s why, behind the scenes, I’ve been working with the Ministry of Education and NZEduTech to introduce a Privacy Pledge—a voluntary self-assessment tool designed to help all vendors lift their game. This initiative will launch soon, and it aims to raise the bar across the entire sector.
I know this shouldn’t be something school leaders have to worry about. You already have enough on your plate. But sadly, many IT vendors have not kept up with the risks and they’ve cut corners. And that’s simply not good enough. This is a critical issue, and I’m committed to raising awareness and helping lift standards across the board.
Ngā mihi
References:
The ST4S badge to look out for and also NOTE the date it was assessed:
Attachments
- 5 questions flyer PDF, 129.5 KB
