Protecting Student Data: Privacy Basics for Institutes

An institute knows a lot about its students: names, phone numbers, parents' contacts, addresses, marks and payments. Parents trust you with that. Protecting it is part of running a good institute, and in Nepal the right to privacy is protected by law.

Collect only what you need

For an online course you usually need a name, a phone number or email, and the course. Ask for more only when there is a clear reason, and explain it.

Give staff only the access they need

A teacher needs their students' progress, not every family's payment history. Use roles: teachers, accountants and managers each see what their job requires. When someone leaves, turn off their access the same day.

Stop sharing lists in chats

Spreadsheets of students forwarded in WhatsApp groups are the most common leak. Keep student data inside your system, and export only when necessary, to the person who needs it.

Secure every sign-in

• Each staff member has their own account; never share one admin login.
• Use long passwords, and two-step sign-in where possible.
• Lock accounts after repeated wrong passwords.

Keep a record of changes

An audit log of who changed what, and when, helps you answer questions, fix mistakes and spot misuse early.

Be careful with photos and results

Ask permission before using a student's photo, name or result in marketing. Students under 18 need a parent's agreement.

Plan for problems

Know who to call if a phone with admin access is lost, or if data is shared by mistake: change passwords, review the audit log, and tell affected families honestly.

How Lariyo helps

Lariyo keeps each institute's data separate, gives staff role-based access, logs admin actions, encrypts video and limits student devices. See security and team and audit.