Start with the information involved
List the information a proposed workflow needs. An anonymous practice example and a live student assessment record create different questions. Ask whether names, identifiers, responses, results or sensitive information are required.
Use the school’s procurement and privacy process to determine which rules apply. The applicable legal position depends on the school, the provider, the information and the circumstances.
Follow the information beyond the screen
Ask where information is collected, processed, stored and backed up. Include support systems, analytics, logs and any AI provider. Request the actual arrangements for the proposed deployment rather than relying on a country flag or a hosting logo.
- What information is sent to each provider?
- Can it be used for model training or another purpose?
- Which school and provider staff can access it?
- What are the retention, export and deletion arrangements?
- How are access mistakes and incidents handled?
Do not assume one consent rule fits every child
OAIC guidance says a young person’s capacity to consent depends on their understanding and maturity. It is not accurately described by a blanket statement that all minors cannot consent. Schools should apply their own requirements and seek appropriate advice.
Explain the proposed use in language the affected people can understand. A lengthy vendor policy does not by itself answer the school’s practical questions.
Understand incident reporting
OAIC’s Notifiable Data Breaches guidance describes notifying as soon as practicable when the notification obligation applies, and taking reasonable steps to complete a suspected eligible-breach assessment within 30 days.
Ask the provider who investigates, who contacts the school and how responsibilities are documented. A provider’s contractual commitment and a legal requirement are not interchangeable.
Keep public examples separate from school records
The GoHiMark public tools do not require student records. Use fictional or non-sensitive information when exploring a preview and leave student details out of contact enquiries.
This article is a practical discussion guide, not a legal opinion or a statement that GoHiMark has completed a school privacy assessment. Confirm current requirements through your school and the relevant authority.
Further reading
These sources offer further context. Links do not imply endorsement of GoHiMark.
Explore the question examples or estimate a task with the marking workload planner.