Adapt this template. It is not an ADEK policy, and completing it does not by itself meet a regulatory requirement. Replace every placeholder in brackets and keep a version date.
Establishing
Personal accounts, a same-day leaver process, and one successful restore.
Reliable
Access is requested and removed in writing. Staff do not keep parent lists privately. Filtering is on.
Strong
Leaders can point to lessons where technology changed the thinking. Incidents have a written path that was used at least once in a drill.
Reference practice
A substitute IT person can follow the procedure. Data protection is a habit in admissions and HR, not a poster in the server room.