Skip to content
Classio

Guide

What Schools Should Check Before Entrusting Personal Data to the Cloud

What a school in Japan should check before entrusting student and guardian data to a cloud service: supervising the contractor under the APPI, sensitive personal information, access and logs, storage location and data at contract end.

Request a consultationExplore the platform

In short

Before a school entrusts student and guardian data to a cloud service, check (1) whether the data includes special care-required personal information, (2) whether the vendor is a suitable contractor — selection, contract and oversight, (3) who can see what, and whether viewing and changes are logged, (4) where data is stored and which external services receive it, and (5) how you receive and delete the data when the contract ends.

Last updated: October 26, 2026

Personal information schools handle

Schools handle names, addresses and contacts, grades, attendance, family circumstances, residence card details and more. Medical history, disability and health-check results are “special care-required personal information” (要配慮個人情報) under Japan’s Act on the Protection of Personal Information (APPI), and acquiring them generally requires the person’s consent.

Sorting which information falls into which category first makes it easier to decide who may see it and how it is sent outside. This page follows the Personal Information Protection Commission’s General Guidelines for private-sector businesses such as private schools; public schools fall under separate rules for local-government bodies.

Supervising the contractor

When a cloud service handles personal data for you, you must supervise it as a contractor. The guidelines list choosing a suitable contractor, concluding a contract and keeping track of how the data is handled.

  • Selection: confirm the vendor’s security measures through documents and questions.
  • Contract: include security, conditions for subcontracting, incident reporting and end-of-contract handling.
  • Oversight: agree how you will check handling regularly (reports, documentation).
  • Subcontracting: confirm the conditions and the names of subcontractors.

Access rights and viewing logs

  • Can you separate, by role, which records can be viewed and which changed?
  • Can homeroom and subject teachers be kept from students they do not teach?
  • Can the display of especially sensitive data — addresses, health — be restricted?
  • Are viewing and changes recorded — who, when, which record — and can you check them later?
  • Can access be removed at once when staff move or leave?

Storage location and external services

Confirm in which country and where the data is stored. If personal data is handled abroad, security measures must take that country’s personal-information system into account.

Features such as notifications, payments or AI may send data to other businesses. Get a list of which feature sends which information where.

Data at the end of the contract

  • Which data you receive, and in what format (CSV, for example), when the contract ends.
  • The deadline for receiving it, and any fee.
  • When and how data is deleted from the vendor’s environment, and how deletion is confirmed.
  • What happens to data left in backups.

Where MEXT’s security guidelines fit

MEXT’s guidelines on education information security policy are mainly for boards of education and public schools drafting and reviewing their security policies. They cover cloud service use and technical measures.

Private schools drafting their own rules can also use them to list items to check.

Checklist

Get a written answer from each candidate on these items. The list prints.

  1. 1Have you sorted your data categories, including special care-required information?
  2. 2Have you confirmed the vendor’s security measures in writing?
  3. 3Does the contract cover security, subcontracting, incident reporting and end-of-contract handling?
  4. 4Can rights be set by role, and can staff be kept from students they do not teach?
  5. 5Can the school check viewing and change logs?
  6. 6Is the storage location (country and region) known?
  7. 7Is it clear which feature sends which data to which external service?
  8. 8Are export and deletion at the end of the contract defined?

In Classio

Where Classio stores data, role-based rights, operation logs, information sent to external services, and export and deletion at the end of the contract are set out on the security page.

Frequently asked questions

Is entrusting data to a cloud service a “provision to a third party”?
When you entrust the handling of personal data within the scope needed for your purpose, the contractor is not treated as a third party (APPI Article 27(5)(i)). In exchange, you must supervise the contractor.

Related pages

Security and accessCloud or on-premises?How to chooseMigration and switchingRFP template

Sources

Regulatory statements follow the scope of the cited documents. External documents do not certify Classio’s behaviour or compliance.

Sources checked: October 18, 2026

Start from how you work today

We can send Classio’s answers to this checklist.

If your school has its own rules or review form, we will answer in that format.

Request a consultationRequest materials