Gerald Ajam

Privacy, security and ethics glossary

70 terms from R17, Privacy, security and ethics: 21 defined in the guide itself and 49 more from the field around it. Every term the guide teaches links to the slide that teaches it.

The whole craft glossary

R17 · How to improve

Privacy, security and ethics

What could go wrong with student data, and for whom?

Every term below is defined in the words of privacy, security and ethics, guide R17 of craft guides for educational technologists. Each term the guide teaches opens it at the slide where it is taught. 49 of the 70 are the field’s vocabulary rather than the guide’s own: words a reader will meet around this subject, defined here because the guide assumes them. 1 term is also defined by another guide in the series. Where the two differ, both wordings are given. The whole craft glossary holds all of them together.

TermDefinitionReferred to inRead further
A
Access control

The rules that decide who can reach which data and actions. OWASP lists its failure first among web application risks (OWASP Foundation, 2025).

  • Obar, J. A., & Oeldorf-Hirsch, A. (2020). The biggest lie on the Internet: Ignoring the privacy policies and terms of service policies of social networking services. Information, Communication & Society, 23(1), 128–147. doi
  • Ministry of Education, Singapore. (2024c). Mobile Guardian device management application to be removed from personal learning devices [Press release]. moe.gov.sg
Age Appropriate Design Code

The United Kingdom regulator's statutory code of 15 standards for online services likely to be used by under-18s, including high privacy by default and no nudging to give up data. Also called the Children's Code.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Information Commissioner's Office. (2020). Age appropriate design: A code of practice for online services. Information Commissioner's Office.
Aggregation

Combining pieces of information about a person so that together they reveal more than each does alone (Solove, 2006).

  • Privacy Technical Assistance Center. (2014). Protecting student privacy while using online educational services: Requirements and best practices. U.S. Department of Education. studentprivacy.ed.gov
  • Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–560. doi
Algorithmic bias

A system that performs systematically worse, or produces worse outcomes, for some groups than for others (Baker & Hawn, 2022).

  • Baker, R. S., & Hawn, A. (2022). Algorithmic bias in education. International Journal of Artificial Intelligence in Education, 32(4), 1052–1092. doi
  • Feathers, T. (2023). False alarm: How Wisconsin uses race and income to label students “high risk”. The Markup. themarkup.org
Anonymisation

Altering data so that no person can be identified from it by any means reasonably likely to be used. Truly anonymised data falls outside data protection law.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Article 29 Data Protection Working Party. (2014). Opinion 05/2014 on anonymisation techniques (WP 216). European Commission.
  • Ohm, P. (2010). Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law Review, 57(6), 1701–1777.
Assume breach

Designing and operating a system as if an account or component will be misused, and planning the response in advance.

  • Perdomo, J. C., Britton, T., Hardt, M., & Abebe, R. (2023). Difficult lessons on social prediction from Wisconsin public schools [Preprint]. arXiv. doi
  • U.S. Department of Education. (n.d.). Family Educational Rights and Privacy Act (FERPA). Student Privacy Policy Office. Retrieved September 17, 2026, from studentprivacy.ed.gov
Attack surface

Every point at which an attacker could try to get into or take data out of a system: login pages, APIs, integrations, devices and the people who use them.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Manadhata, P. K., & Wing, J. M. (2011). An attack surface metric. IEEE Transactions on Software Engineering, 37(3), 371–386. doi
  • Shostack, A. (2014). Threat modeling: Designing for security. Wiley.
Audit log

A protected record of who did what in a system and when, such as who viewed or exported a student's record, used to detect misuse and investigate incidents.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Kent, K., & Souppaya, M. (2006). Guide to computer security log management (NIST Special Publication 800-92). National Institute of Standards and Technology. doi
Authentication and authorisation

Authentication proves who a user is; authorisation decides what that user may see or do. Many breaches of student data come from a failure of the second.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017). Digital identity guidelines (NIST Special Publication 800-63-3). National Institute of Standards and Technology. doi
  • OWASP Foundation. (2021). OWASP Top 10:2021. OWASP Foundation.
Automated decision-making

A decision about a person made by a system with no meaningful human involvement, such as automatic grading or placement. Several laws give a right to human review.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Wachter, S., Mittelstadt, B., & Floridi, L. (2017). Why a right to explanation of automated decision-making does not exist in the General Data Protection Regulation. International Data Privacy Law, 7(2), 76–99. doi
B
Bias audit

A test, before launch and at intervals after, of whether a model's accuracy and errors differ between groups of students, such as by sex, ethnicity, language or disability.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Baker, R. S., & Hawn, A. (2022). Algorithmic bias in education. International Journal of Artificial Intelligence in Education, 32(4), 1052–1092. doi
  • Barocas, S., Hardt, M., & Narayanan, A. (2023). Fairness and machine learning: Limitations and opportunities. MIT Press.
Biometric data

Data from a person's body or behaviour that can identify them, such as a face image, fingerprint or voice print, used in some attendance, payment and proctoring systems.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Buolamwini, J., & Gebru, T. (2018). Gender shades: Intersectional accuracy disparities in commercial gender classification. Proceedings of Machine Learning Research, 81, 77–91.
Breach notification

The legal duty to tell the regulator, and often the people affected, about a personal data breach within a set time: 72 hours under the GDPR, three calendar days in Singapore.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
C
Children's Online Privacy Protection Act (COPPA)

The 1998 United States law that requires online services directed at children under 13, or knowingly collecting their data, to obtain verifiable parental consent first.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506.
  • Children's Online Privacy Protection Rule, 16 C.F.R. Part 312.
Children's rights by design

Designing digital products so that they respect children's rights to privacy, protection, participation, play and education from the outset.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • United Nations Committee on the Rights of the Child. (2021). General comment No. 25 (2021) on children's rights in relation to the digital environment (CRC/C/GC/25). United Nations.
  • United Nations. (1989). Convention on the Rights of the Child. United Nations.
Click-wrap agreement

Terms accepted by clicking a button, which can bind a school as a signed contract would (Privacy Technical Assistance Center, 2014).

  • Personal Data Protection Commission. (2024b). Advisory guidelines on the PDPA for children’s personal data in the digital environment. pdpc.gov.sg
Confidentiality, integrity and availability (CIA triad)

The three aims of information security: data is seen only by those allowed, is not altered without authority, and is there when needed.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • National Institute of Standards and Technology. (2004). Standards for security categorization of federal information and information systems (FIPS PUB 199). National Institute of Standards and Technology.
  • Anderson, R. (2020). Security engineering: A guide to building dependable distributed systems (3rd ed.). Wiley. doi
Consequence scanning

A short team event that asks about intended and unintended consequences of a product or feature (Doteveryone, 2019).

  • Doteveryone. (2019). Consequence scanning: An agile event for responsible innovators (Version 1). doteveryone.org.uk
Contextual integrity

The idea that a flow of personal information is appropriate when it fits the norms of the setting it came from (Nissenbaum, 2004).

  • National Institute of Standards and Technology. (2020). NIST Privacy Framework: A tool for improving privacy through enterprise risk management, version 1.0. doi
Cross-border data transfer

Sending personal data to, or allowing access to it from, another country. Many laws permit this only if the data stays comparably protected, which affects where a vendor may host.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
D
Dark pattern

An interface design that steers people into choices they would not otherwise make, such as a pre-ticked consent box or a hidden opt-out.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Gray, C. M., Kou, Y., Battles, B., Hoggatt, J., & Toombs, A. L. (2018). The dark (patterns) side of UX design. In Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems (Paper 534). ACM. doi
  • Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M., & Narayanan, A. (2019). Dark patterns at scale: Findings from a crawl of 11K shopping websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW), Article 81. doi
Data controller and data processor

The controller decides why and how personal data is processed; the processor handles it on the controller's behalf. A school is usually the controller and its edtech vendor the processor.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
Data processing agreement

The contract that binds a vendor to handle personal data only on the school's or ministry's instructions, keep it secure, name its sub-processors and return or delete it at the end.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
Data protection impact assessment (DPIA)

A structured assessment of the risks a data processing activity poses to people, and how to reduce them. Some regimes require one in certain cases.

  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88. eur-lex.europa.eu
  • Human Rights Watch. (2022). “How dare they peep into my private life?”: Children’s rights violations by governments that endorsed online learning during the Covid-19 pandemic. hrw.org
  • Personal Data Protection Commission. (2024a). Advisory guidelines for the education sector. pdpc.gov.sg
Data protection officer (DPO)

The person an organisation appoints to oversee its compliance with data protection law, advise on impact assessments and deal with the regulator and the public.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
Data subject rights

The rights people have over data about them, such as to see it, correct it, have it erased, object to its use and take it elsewhere.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
Default setting

What a product does when a user changes nothing. For most children, the default is the only setting.

  • Cavoukian, A. (2011). Privacy by design: The 7 foundational principles. Implementation and mapping of fair information practices. Information and Privacy Commissioner of Ontario. student.cs.uwaterloo.ca
  • Human Rights Watch. (2022). “How dare they peep into my private life?”: Children’s rights violations by governments that endorsed online learning during the Covid-19 pandemic. hrw.org
  • Personal Data Protection Commission. (2024a). Advisory guidelines for the education sector. pdpc.gov.sg
Differential privacy

A mathematical guarantee that a published statistic changes very little whether or not any one person's data is included, achieved by adding calibrated random noise.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006). Calibrating noise to sensitivity in private data analysis. In S. Halevi & T. Rabin (Eds.), Theory of cryptography (pp. 265–284). Springer. doi
  • Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3–4), 211–407. doi
Disparate impact

Harm that falls more heavily on a protected group from a rule or model that is neutral on its face, whatever the intent behind it.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Griggs v. Duke Power Co., 401 U.S. 424 (1971).
  • Barocas, S., & Selbst, A. D. (2016). Big data's disparate impact. California Law Review, 104(3), 671–732.
Dropout Early Warning System (DEWS)

Wisconsin’s system for labelling students by dropout risk, piloted in 2012, whose false alarm rate the state’s own 2021 analysis found 42 percentage points higher for Black students than for White students (Feathers, 2023).

  • Feathers, T. (2023). False alarm: How Wisconsin uses race and income to label students “high risk”. The Markup. themarkup.org
  • Page, C. (2025). What PowerSchool won’t say about its data breach affecting millions of students. TechCrunch. techcrunch.com
E
Encryption at rest

Encrypting stored data, in databases, backups and laptops, so that a stolen disk or copied file cannot be read without the key.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Scarfone, K., Souppaya, M., & Sexton, M. (2007). Guide to storage encryption technologies for end user devices (NIST Special Publication 800-111). National Institute of Standards and Technology. doi
  • Anderson, R. (2020). Security engineering: A guide to building dependable distributed systems (3rd ed.). Wiley. doi
Encryption in transit

Encrypting data as it moves between a device and a server or between servers, usually with TLS, so that it cannot be read or altered on the way.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Rescorla, E. (2018). The Transport Layer Security (TLS) protocol version 1.3 (RFC 8446). Internet Engineering Task Force. doi
Ethics review board

A committee that reviews research involving people before it starts, weighing risks, benefits, consent and fairness. It is called an institutional review board (IRB) in the United States.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Protection of Human Subjects, 45 C.F.R. Part 46 (2018).
  • National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. (1979). The Belmont report: Ethical principles and guidelines for the protection of human subjects of research. U.S. Department of Health, Education, and Welfare.
F
Fairness metric

A statistic that compares a model's behaviour across groups, such as selection rates or error rates. The common metrics cannot all be met at once, so one must be chosen and justified.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Barocas, S., Hardt, M., & Narayanan, A. (2023). Fairness and machine learning: Limitations and opportunities. MIT Press.
  • Chouldechova, A. (2017). Fair prediction with disparate impact: A study of bias in recidivism prediction instruments. Big Data, 5(2), 153–163. doi
False alarm

A prediction that flags a person as at risk who would not have had the outcome predicted. Also called a false positive.

R15 A student flagged as at risk who would have been fine. Also called a false positive.

  • Bowers, A. J., Sprott, R., & Taff, S. A. (2013). Do we know who will drop out? A review of the predictors of dropping out of high school: Precision, sensitivity, and specificity. The High School Journal, 96(2), 77–100. doi
  • Feathers, T. (2023). False alarm: How Wisconsin uses race and income to label students “high risk”. The Markup. themarkup.org
Family Educational Rights and Privacy Act (FERPA)

The 1974 United States law that gives parents, and students from 18, rights over education records, and limits what a school receiving federal funds may disclose without consent.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g.
  • Family Educational Rights and Privacy, 34 C.F.R. Part 99.
Function creep

The gradual use of data or a system for purposes beyond the one it was set up for, such as attendance data reused for discipline.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Koops, B.-J. (2021). The concept of function creep. Law, Innovation and Technology, 13(1), 29–56. doi
G
General Data Protection Regulation (GDPR)

The European Union's data protection law, in force since 2018. It applies to anyone who offers services to, or monitors, people in the Union, and is the model for many later laws.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
I
Incident response plan

The agreed steps for a security incident: who decides, how to contain it, how to recover, whom to tell and how to learn from it afterwards.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST Special Publication 800-61, Rev. 2). National Institute of Standards and Technology. doi
ISO/IEC 27001

The international standard for an information security management system. An organisation is certified against it by an accredited auditor, and buyers often ask vendors for the certificate.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • International Organization for Standardization & International Electrotechnical Commission. (2022). Information security, cybersecurity and privacy protection: Information security management systems: Requirements (ISO/IEC 27001:2022).
K
k-anonymity

A property of a released dataset in which each record matches at least k−1 others on the attributes that could identify someone, so that no one stands alone.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Sweeney, L. (2002). k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557–570. doi
L
Lawful basis

The legal ground an organisation relies on to process personal data, such as consent, contract, legal obligation, public task or legitimate interests. Schools seldom need to rely on consent.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
Least privilege

Giving each account only the access it needs for its job, and no more.

  • Obar, J. A., & Oeldorf-Hirsch, A. (2020). The biggest lie on the Internet: Ignoring the privacy policies and terms of service policies of social networking services. Information, Communication & Society, 23(1), 128–147. doi
M
Multi-factor authentication (MFA)

A login that needs two or more kinds of evidence, such as a password and a code from a device.

  • Ministry of Education, Singapore. (2024a). No sensitive data compromised from unauthorised access into Mobile Guardian’s systems [Press release]. moe.gov.sg
  • Information Commissioner’s Office. (2023). The Children’s code and education technologies (edtech). ico.org.uk
N
NIST Privacy Framework

A voluntary framework for managing privacy risk as ongoing work, which draws privacy risk and cybersecurity risk as two overlapping circles, with breaches where they meet (National Institute of Standards and Technology, 2020).

  • Ministry of Education, Singapore. (2024c). Mobile Guardian device management application to be removed from personal learning devices [Press release]. moe.gov.sg
O
OWASP Top 10

A regularly updated list of the most serious security risks in web applications, such as broken access control and injection, widely used as a baseline in procurement and testing.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • OWASP Foundation. (2021). OWASP Top 10:2021. OWASP Foundation.
P
Penetration test

An authorised attack on a system by specialists, to find weaknesses before a real attacker does; often required before launch or in a contract.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical guide to information security testing and assessment (NIST Special Publication 800-115). National Institute of Standards and Technology. doi
Personal data

Any information about an identified or identifiable living person, including a student number, device identifier or learning record that can be linked to a student. United States usage is personally identifiable information (PII).

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
  • McCallister, E., Grance, T., & Scarfone, K. (2010). Guide to protecting the confidentiality of personally identifiable information (PII) (NIST Special Publication 800-122). National Institute of Standards and Technology. doi
Personal Data Protection Act (PDPA)

Singapore's 2012 data protection law for private organisations, including edtech vendors. Government agencies, and so government schools, follow separate public sector rules.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Personal Data Protection Act 2012 (2020 Rev. Ed.) (Singapore).
Phishing

A message that poses as a trusted sender to trick someone into giving a password, opening a file or paying a false invoice. Aimed at one named person, it is spear phishing.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007). Social phishing. Communications of the ACM, 50(10), 94–100. doi
  • Mitnick, K. D., & Simon, W. L. (2002). The art of deception: Controlling the human element of security. Wiley.
Privacy by design

Building privacy into systems from the start and by default, rather than adding it later (Cavoukian, 2011).

  • Cavoukian, A. (2011). Privacy by design: The 7 foundational principles. Implementation and mapping of fair information practices. Information and Privacy Commissioner of Ontario. student.cs.uwaterloo.ca
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88. eur-lex.europa.eu
  • Human Rights Watch. (2022). “How dare they peep into my private life?”: Children’s rights violations by governments that endorsed online learning during the Covid-19 pandemic. hrw.org
Privacy harm

Any problem a person experiences because of how data about them is handled, such as being tracked, sorted, exposed, excluded or put at risk of fraud.

  • Ministry of Education, Singapore. (2024c). Mobile Guardian device management application to be removed from personal learning devices [Press release]. moe.gov.sg
  • Privacy Technical Assistance Center. (2014). Protecting student privacy while using online educational services: Requirements and best practices. U.S. Department of Education. studentprivacy.ed.gov
Privacy notice

The plain statement given to students and parents of what data is collected, why, who receives it, how long it is kept and what rights they have.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Information Commissioner's Office. (2020). Age appropriate design: A code of practice for online services. Information Commissioner's Office.
Privacy self-management

Protecting privacy mainly through notice and individual consent (Solove, 2013).

  • Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–560. doi
  • Kapko, M. (2025). PowerSchool hacker sentenced to 4 years in prison. CyberScoop. cyberscoop.com
  • Nissenbaum, H. (2004). Privacy as contextual integrity. Washington Law Review, 79(1), 119–157. digitalcommons.law.uw.edu
Problematic data action

A data operation that could cause a problem for individuals, in NIST’s terms (National Institute of Standards and Technology, 2020).

  • Ministry of Education, Singapore. (2024c). Mobile Guardian device management application to be removed from personal learning devices [Press release]. moe.gov.sg
Pseudonymisation

Replacing names and other identifiers with codes, with the key held separately. The data remains personal data, because whoever holds the key can reverse it.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
  • Article 29 Data Protection Working Party. (2014). Opinion 05/2014 on anonymisation techniques (WP 216). European Commission.
R
Ransomware

Malicious software that encrypts an organisation's files, and often steals a copy, then demands payment for their return. Schools and districts are frequent targets.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). National Institute of Standards and Technology. doi
  • Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST Special Publication 800-61, Rev. 2). National Institute of Standards and Technology. doi
Re-identification

Working out who a record in a supposedly anonymous dataset belongs to, usually by linking it with other data. Small schools and rare characteristics make students easy to single out.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Narayanan, A., & Shmatikov, V. (2008). Robust de-anonymization of large sparse datasets. In 2008 IEEE Symposium on Security and Privacy (pp. 111–125). IEEE. doi
  • Sweeney, L. (2002). k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557–570. doi
Remote proctoring

Invigilating an examination through the candidate's own device, using webcam, microphone, screen recording and often automated flagging of suspect behaviour.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Coghlan, S., Miller, T., & Paterson, J. (2021). Good proctor or "Big Brother"? Ethics of online exam supervision technologies. Philosophy & Technology, 34(4), 1581–1606. doi
S
School official exception

The FERPA provision that lets a school share education records with a vendor without parental consent, if the vendor does a job the school would otherwise do, under the school's direct control.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Family Educational Rights and Privacy, 34 C.F.R. Part 99.
Secondary use

Using data for a purpose other than the one it was collected for (Solove, 2006).

  • Privacy Technical Assistance Center. (2014). Protecting student privacy while using online educational services: Requirements and best practices. U.S. Department of Education. studentprivacy.ed.gov
  • Federal Trade Commission. (2026). FTC gives final approval to order against Illuminate settling allegations it failed to secure students’ personal data [Press release]. ftc.gov
Single sign-on (SSO)

One login, usually the school's or ministry's identity service, that opens many applications, so that accounts are created, checked and closed in one place.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Hardt, D. (Ed.). (2012). The OAuth 2.0 authorization framework (RFC 6749). Internet Engineering Task Force. doi
  • Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017). Digital identity guidelines (NIST Special Publication 800-63-3). National Institute of Standards and Technology. doi
SOC 2

An independent auditor's report on a service provider's controls for security, availability, processing integrity, confidentiality and privacy. Type 1 covers design at a date; Type 2 covers operation over a period.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • American Institute of Certified Public Accountants. (2017). Trust services criteria for security, availability, processing integrity, confidentiality, and privacy. AICPA.
Solove’s taxonomy of privacy

A grouping of privacy problems under information collection, information processing, information dissemination and invasion, with 16 kinds of harm between them, each needing a different fix (Solove, 2006).

  • Privacy Technical Assistance Center. (2014). Protecting student privacy while using online educational services: Requirements and best practices. U.S. Department of Education. studentprivacy.ed.gov
Special category data

Kinds of personal data given extra legal protection because misuse does serious harm, such as health, ethnicity, religion and biometric data. Special educational needs records usually fall here.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88.
T
Third party

Any organisation other than the school and the family that receives or can reach student data, including vendors, their contractors and embedded code.

  • U.S. Department of Education. (n.d.). Family Educational Rights and Privacy Act (FERPA). Student Privacy Policy Office. Retrieved September 17, 2026, from studentprivacy.ed.gov
  • Federal Trade Commission. (2026). FTC gives final approval to order against Illuminate settling allegations it failed to secure students’ personal data [Press release]. ftc.gov
Threat model

A structured account of what a system holds, who might attack it, how, and what would stop them, written before the build so that defences follow the risks.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Shostack, A. (2014). Threat modeling: Designing for security. Wiley.
V
Vulnerability

A weakness in software, configuration or process that an attacker could use. One that is attacked before the maker has a fix is a zero-day.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Bilge, L., & Dumitraş, T. (2012). Before we knew it: An empirical study of zero-day attacks in the real world. In Proceedings of the 2012 ACM Conference on Computer and Communications Security (pp. 833–844). ACM. doi
  • Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Rev. 1). National Institute of Standards and Technology. doi
Vulnerability disclosure

A published route by which outsiders can report a security flaw and have it handled without legal threat. A bug bounty adds payment for valid reports.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • International Organization for Standardization & International Electrotechnical Commission. (2018). Information technology: Security techniques: Vulnerability disclosure (ISO/IEC 29147:2018).
Z
Zero trust

A security model that trusts no user or device because of its network location, and checks identity and device on each request for a resource.

  • R17Privacy, security and ethicsFrom the field · not in the guide
  • Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. doi

Nearby

The guide itself, and the ones either side

Read privacy, security and ethics (opens in a new tab)AI in learning products Basic statistics for educational technologists All 22 guides
Singapore