Schools Are Becoming Increasingly Digital: Who Is Protecting Student Data?

Introduction

Digital transformation expands the benefits of data while raising schools' responsibility to safeguard student information security and privacy.

The digitalization of schools causes educational activities to leave an ever-growing data footprint.

Student identity data is recorded upon enrollment. Daily attendance is logged. Grades, assignments, exam results, academic histories, parent details, school fee payments, and in specific contexts, counseling records and biometric data are now managed via digital systems.

This data empowers schools to operate faster and make well-informed decisions. However, an unavoidable reality remains: the more digital a school becomes, the greater its duty to protect the data entrusted to it by students and parents.

The core issue is not merely having applications or servers capable of storing information. The fundamental questions are:

Who is authorized to view this data? For what purposes is it processed? Where is it hosted? How is access logged? What happens if an account is compromised? And how does the school respond during a security incident?

These inquiries are critical because student information is no longer just an administrative record. In a digital educational ecosystem, student data has become a critical digital asset.

Schools Manage Far More Data Than We Realize

Digital transformation turns educational institutions into highly data-intensive organizations.

Research by Sutarsih and Haryati emphasizes that school digitalization encompasses not only teaching processes, but also the management of students, faculty, curriculum, resources, budget, and institutional communications.

In school management software implementations, the data scope is even broader. Documentation from KBS SMS illustrates that a school management system integrates student records, staff, schedules, attendance, curricula, examinations, personnel, and finances.

A comprehensive digital school ecosystem commonly stores and processes:

• Student and parent personal identities;
• Residential addresses and contact details;
• Class placements and academic records;
• Grades, assignments, report cards, and exam metrics;
• Attendance data;
• Tuition fees, invoices, and billing histories;
• In-system student activity logs;
• Administrative documentation;
• Counseling or behavioral notes (when digitized);
• Photos or biometric data for specialized identification.

As school systems become more interconnected, the value of the stored data surges—along with the severity of consequences should unauthorized parties gain access.

Student Data Is Not Just Administrative Information

Indonesia established a robust legal framework addressing this through Law Number 27 of 2022 on Personal Data Protection (UU PDP).

The law explicitly classifies children's data as Specific Personal Data, alongside sensitive categories such as health records, biometrics, genetics, criminal records, and personal financial information. (JDIH Kemkomdigi)

This distinction is crucial. Schools must not treat student records as mere administrative files kept for convenience. This data is tied to individuals—most of whom are minors.

Under the PDP Law, processing children's personal data requires specialized handling and mandatory consent from parents or legal guardians in accordance with regulatory provisions. (JDIH Kemkomdigi)

Digital education places schools into a new realm of responsibility: schools are not merely technology users, but active custodians accountable for personal data governance.

Cyber Threats Against Education Are Not Theoretical

Cybersecurity is often misconstrued as an issue exclusive to tech enterprises, financial institutions, or government agencies. Empirical data proves otherwise.

The Verizon 2025 Data Breach Investigations Report (DBIR) documented 1,075 security incidents in the Educational Services sector, with 851 confirmed data breach disclosures.

Three primary patterns—system intrusion, miscellaneous errors, and social engineering—account for roughly 80% of breaches in the sector. Personal data was compromised in 58% of breaches, while credentials appeared in 12%. (Verizon)

These findings highlight that attacks on education do not require futuristic exploits. They stem from system vulnerabilities, ransomware, stolen credentials, and human error.

Verizon notes that stolen credentials appeared in 24% of hacking variations in education, while phishing dominated social engineering incidents. Globally, third-party involvement in breaches rose to roughly 30%—doubling from the previous year. (Verizon)

For schools, this is directly relevant because the digital education ecosystem increasingly depends on third parties: applications, cloud providers, payment gateways, messaging tools, LMS, and device vendors.

Usernames and Passwords Are No Longer Enough

Many organizations still view cybersecurity as a simple login checkpoint: "Our system is secure because every user has a username and password."

In reality, passwords themselves are a frequent point of failure.

Verizon's DBIR 2025 analysis revealed that compromised credentials served as the initial access vector in approximately 22% of analyzed breaches. (Verizon)

Credentials are compromised via phishing, infostealer malware, password reuse, and credential stuffing. If a system relies solely on basic credentials without layered safeguards, a single compromised account can expose thousands of student records.

Modern security must evolve from asking: "Is the password correct?" to asking: "Who is this user, what are their explicit permissions, what data is strictly necessary, where is the request originating, and is this activity standard?"

From Password-Based Security to Layered Security

Safeguarding institutional data requires multiple coordinated security layers:

1. Role-Based Access Control (RBAC)
Not all school staff require universal data access. Subject teachers need student grades for their classes, not school-wide financial ledgers. Finance staff require billing details, not confidential counseling logs. Access must strictly follow the principle of least privilege.

2. Multi-Factor Authentication (MFA)
Passwords can be compromised. For privileged accounts such as system administrators, multi-factor authentication provides an essential defensive layer that prevents a single stolen credential from granting full access.

3. Audit Trail: Who Did What?
Security extends beyond preventing unauthorized entry. Schools must maintain records of who accessed what data, when it occurred, and what modifications were made. Audit trails facilitate investigations and establish institutional accountability.

4. Encryption: Protecting Data, Not Just the System
School data exists in two primary states: data at rest (stored in databases, servers, devices, or backups) and data in transit (moving between user devices and servers). Both must be shielded through strong encryption mechanisms.

5. Backup and Recovery
Data loss occurs through corruption, accidental deletion, ransomware encryption, or hardware failure. Schools need disciplined backup schedules and, crucially, regularly tested recovery procedures.

6. Data Minimization
The most effective defense precedes any cyberattack: do not collect unnecessary data. Data processing must remain limited, purposeful, transparent, and lawful.

7. Privacy-by-Design
Privacy cannot be an afterthought added post-development. Security, consent, retention, logging, and access boundaries must be engineered into systems and workflows from day one.

Cybersecurity Is Not Exclusively an IT Responsibility

Viewing cybersecurity strictly as an IT department concern is a critical mistake. Modern attacks heavily exploit human behavior.

Verizon DBIR 2025 shows that human involvement remains prominent in breaches through social engineering and credential abuse. A teacher may fall for phishing, an administrator may reuse passwords, or staff might transmit sensitive files to unintended recipients.

School security depends on the balance of: People + Process + Technology. Strong tech without security-conscious behavior remains vulnerable.

Schools Require Data Governance, Not Just Cybersecurity

While cybersecurity asks: How do we prevent unauthorized access or attacks?, data governance addresses broader questions: What data do we hold, why do we collect it, who owns it, who can use it, how long is it retained, and when is it securely deleted?

Schools need clear governance across the full lifecycle:
Data Ownership → Data Classification → Access → Processing → Storage → Sharing → Retention → Deletion → Incident Response.

The Challenge of Multi-Application Sprawl

Risk multiplies when student data is fragmented across disconnected tools (attendance apps, exam portals, fee gateways, parent messaging apps, LMS, and extra spreadsheets). Each standalone system introduces separate credentials, databases, and vendor risks, widening the overall attack surface.

Integrated systems, when architected securely, form an essential pillar of robust data governance.

The Role of a School Management System

A unified School Management System (such as KBS SMS) structures institutional governance by consolidating student records, academic tracking, attendance, staff management, and finances into a single ecosystem.

However, deploying management software does not automatically guarantee total immunity from cyber threats or instant regulatory compliance. Rather, the platform functions as an essential enabler by providing role-based permissions, centralized data storage, and systematic activity logging.

Trust Is the Invisible Infrastructure

Schools can invest in high-end servers, high-speed networks, and comprehensive digital tools. Yet digital transformation only endures when underpinned by trust.

Parents, students, educators, and administrators rely on the confidentiality and integrity of digital records. When trust erodes, technical problems evolve into institutional failures.

From Digital School to Trusted Digital School

Future-ready schools do not merely amass technology; they deploy technology responsibly.

The transition path follows:
Digital Adoption → Integrated School Systems → Data Governance → Cybersecurity & Privacy → Digital Trust.

Technology provides capability, data provides insight, but trust provides legitimacy to the entire digital educational ecosystem.

Key Data & Facts

• Child data classification in Indonesia: Children's data is categorized as Specific Personal Data under Law No. 27 of 2022. (Source: JDIH Kemkomdigi)
• Processing of child data: Requires specific handling and mandatory parental/guardian consent under legal guidelines. (Source: JDIH Kemkomdigi)
• Education sector security incidents: Verizon DBIR 2025 recorded 1,075 incidents, with 851 confirmed data disclosures in Educational Services. (Source: Verizon)
• Primary breach patterns: System Intrusion, Miscellaneous Errors, and Social Engineering account for ~80% of educational breaches. (Source: Verizon)
• Targeted data categories: Personal data was compromised in 58% of analyzed educational breaches. (Source: Verizon)
• Ransomware share: Ransomware was present in approximately 30% of Educational Services breaches in DBIR 2025. (Source: Verizon)
• Credential risks: Compromised credentials served as the initial access vector in ~22% of breaches. (Source: Verizon)
• Global education risk: UNESCO noted ~5% of global ransomware attacks targeted education in 2022, highlighting limited security budgets. (Source: 2023 GEM Report)
• Average global breach cost: IBM estimated the average cost of a data breach globally at US$4.44 million. (Source: IBM)

Editorial note: Global statistics from Verizon and IBM reflect international cross-industry trends to illustrate risk scale and are not direct estimates of Indonesian school figures.

References

1. Republic of Indonesia. Law Number 27 of 2022 on Personal Data Protection. (BPK Regulation)
2. Ministry of Communication and Digital Affairs RI. JDIH — Law Number 27 of 2022 on Personal Data Protection. (JDIH Kemkomdigi)
3. Verizon. 2025 Data Breach Investigations Report (DBIR). (Verizon)
4. UNESCO. Global Education Monitoring Report 2023: Technology in Education — A Tool on Whose Terms? (2023 GEM Report)
5. IBM Security. Cost of a Data Breach Report 2025. (IBM)
6. Sutarsih, W. & Haryati, T. (2024). Role of School Digitalization on Education Quality. LEARNING Journal, Vol. 4 No. 2.
7. Sinaga, W. M. B. & Firmansyah, A. (2024). Educational Paradigm Shifts in the Digital Era. Journal of Educational Technology, Vol. 1 No. 4.
8. Hasnida, S. S., Adrian, R., & Siagian, N. A. (2024). Educational Transformation in the Digital Era. Jurnal Bintang Pendidikan Indonesia.
9. Purba, P. B., et al. (2025). Education in the Digital Era: Challenges for Generation Z. Yayasan Kita Menulis.
10. KBS SMS (2025). Manual Book KBS SMS Version 2.0. School data management documentation.

Editorial Closing

Digitalization enriches schools with data. Cybersecurity ensures this wealth of data does not become a vulnerability. Data governance guarantees that data is utilized responsibly. And trust ensures the digital future of education remains viable.

A genuinely digital school is not merely one capable of collecting student data—it is an institution worthy of being trusted to protect it.

Copyright Notice
This article is official content of PT. Kreasi Bali Sasmita Nusantara (KBS SMS). Reproduction, distribution, or republishing of any part of this article without written permission from the copyright owner is prohibited.