Confidentiality agreements are often treated as a formality in education partnerships, signed for the sake of it and then filed away. This view overlooks a real fact: the relationship between two schools involves two types of sensitive information whose leakage carries very different consequences.
The first type is organizational information: cost structures, partner lists, unpublished programme content. The second is students’ personal data, and this is the type where mishandling can lead to legal liability.
This article covers the three points at which to sign, the six core clauses, and the separate handling required for student data.
Three points at which to sign
Point one: before exchanging information to assess the potential for cooperation. The initial exploratory stage is when both sides share the most internal information, and also when no obligation yet exists. This is the point most often overlooked.
Point two: when signing the official cooperation agreement. The confidentiality provisions can be a clause within the main agreement, not necessarily a separate document.
Point three: before beginning to transfer student data. This is information of a different nature and usually requires a separate, more detailed document.
Of the three points, the first is where the absence of a written agreement creates the greatest risk. If both sides exchange detailed information about how they operate and then do not proceed with the partnership, the information already shared remains with the other party with no obligation attached.
Six core clauses
One: definition of protected information. This needs to be specific, not an all-encompassing phrase. A definition that is too broad is hard to enforce and is often ignored in practice.
Two: exclusions. Information that is already public, information the recipient already held beforehand, and information that must be disclosed at the request of a competent authority.
Three: scope of use. What purposes the recipient may use the information for. This clause matters more than the non-disclosure clause, because the real risk usually lies in misuse rather than in disclosure.
Four: who within the organization may access it. Access should be limited to those who genuinely need it, and the recipient is responsible for binding those individuals.
Five: term. The term of the agreement should be distinguished from the duration of the confidentiality obligation. The obligation typically continues after the partnership ends.
Six: handling of information at the end of the relationship. Whether it is returned, destroyed, or retained, and for how long. Note that copies in backup systems cannot be deleted immediately, and the clause should reflect this technical reality.
The sixth clause is often written in a way that cannot actually be carried out. A commitment to destroy everything within seven days is unworkable for most storage systems today.
Student data needs a separate clause
This is the most important part, and also the part most often handled carelessly.
Why it needs to be separated. Personal data is governed by legal regulations, not only by the agreement between the two parties. Mutual agreement between the parties is not enough to legitimize a way of handling data that violates the regulations.
What it should contain. What type of data is transferred, the purpose, the legal basis for the transfer, the retention period, and liability in the event of an incident.
Student consent. Transferring data to another organization, especially one in another country, requires clear consent from the student, collected properly and kept on record.
Cross-border data transfer. This is a matter subject to specific rules in many legal systems and should be reviewed by someone with the relevant expertise.
Obligation to notify in the event of an incident. If the recipient allows a leak to occur, within what timeframe and to whom must they report it.
The most practical principle: only transfer the data that is genuinely necessary for the stated purpose. Transferring an entire record for convenience creates unnecessary risk.
A confidentiality agreement cannot replace internal processes
This is a point many organizations get wrong. A signed document does not protect information on its own.
You need to determine who has access. In practice, information often leaks through people not directly involved but who have system access.
You need rules on communication channels. Sending student records via personal accounts or common messaging apps violates the spirit of the agreement even if it does not violate its letter.
You need to train the staff who directly handle the data. People carrying out day-to-day work often do not read the agreement, so a summary of practical rules is needed.
You need to log every transfer. Who sent what, to whom, and when.
This last point has a dual value: it supports oversight, and it serves as evidence when you need to demonstrate that you handled things correctly.
When a partner proposes unfavourable terms
Not every agreement drafted by a partner is balanced. There are four warning signs to watch for.
One-sided obligations. Only one party has a confidentiality obligation while both parties share information.
An overly broad definition. If every piece of exchanged information falls under confidentiality, compliance becomes unworkable and the clause loses its meaning.
An indefinite term. An obligation that lasts forever is a clause that is hard to enforce and is often unreasonable.
Disproportionate penalties. A fixed compensation amount that is far too high relative to the value of the partnership.
How to handle it: propose an adjustment with specific reasons. Most partners use a standard template and are willing to amend it given a reasonable request. Signing a document you know cannot be carried out is worse than spending time negotiating.
Periodic review
A signed agreement needs to be reviewed periodically, not left untouched until the partnership ends.
Check the list of people with access every year. Staff change, and access rights of people who have left are often not revoked.
Compare actual practice against the committed scope. What purposes the data is currently being used for, and whether any use falls outside that scope.
Review the agreement whenever regulations change. Personal data protection regulations change relatively often.
Check for the destruction of data that has served its purpose. Records of people who did not enroll are often kept indefinitely because no one is responsible for deleting them.
This last point is the most common violation in practice and also the easiest to fix, requiring only a retention-period rule and one review each year.
On general principles for protecting student information in international partnerships, the framework of The United Nations Educational, Scientific and Cultural Organization (UNESCO) sets out requirements schools should refer to.
For a comparative view of how different education systems handle data in partnerships, the documentation from the Organisation for Economic Co-operation and Development (OECD) is a useful reference.
Multi-party agreements
In many programmes, information passes through more than two organizations, and a bilateral structure is not enough.
A common scenario. A domestic school, a consulting agency, and an overseas institution all handle the same record. If there are only pairwise agreements, gaps in responsibility will exist.
The risk of a fragmented structure. When a leak occurs, determining responsibility becomes difficult, and each party can point to another.
How to handle it. Either draw up a single joint document covering all parties, or ensure that every bilateral agreement includes a clause on passing obligations on to a third party.
Essential content. Who is the party primarily responsible to the student, and who is the point of contact in the event of an incident.
This last point should also be made clear to the student, since they bear the direct consequences but often do not know where their data resides.
What should be told to students
Data protection is not only a matter between organizations. Students have a right to know.
What data is transferred and to whom. The specific name of the organization should be stated, not a general reference to “partners.”
The purpose of the transfer.
The retention period.
The student’s rights. To view it, to request correction if it is wrong, and to request deletion once its purpose has been fulfilled.
A point of contact for questions.
These five items should be contained in a short document given to every student at the outset, not held back until someone asks.
This approach both meets transparency requirements and has a practical benefit: it forces the school itself to clearly understand where its data is going, and many organizations discover gaps the first time they draft this document.
In addition, this document also serves as a reference when a student requests to view or delete their data. Without a document clearly stating the scope, the school would have to handle each request on a case-by-case basis, which is time-consuming and prone to inconsistent answers across cases.
Practical experience shows that this document should be drafted by the department that directly handles the records, not handed entirely to the legal department. The operational staff know where the data actually goes; the legal department reviews wording and compliance.
Summary
Confidentiality agreements need to be signed at three points, of which the riskiest is the initial exploratory stage, since this is when both sides share the most while no obligation yet exists.
Student data needs a separate clause because it is governed by law, not just by the agreement between the two parties, and the most practical principle is to transfer only what is genuinely necessary.
A signed document does not protect information on its own. Without internal processes for access rights, communication channels, and transfer logging, the agreement is just paper.
Next Steps
Review what data your school is currently transferring to each partner, and compare it against the scope committed to in the document.
If there is no document yet for a partner that is receiving student data, that is the item to address before anything else in that partnership.
