Student Data Has a Lifecycle. Map It.

In my federal grants compliance days, I mapped how money moved through an organization — every intake point, every handoff, every report. Money with no map gets lost. Data works exactly the same way.

Student data enters your school constantly: enrollment forms, attendance systems, learning apps, cafeteria payments, bus GPS, teacher gradebooks, AI tutoring tools. It exits just as constantly: to vendors, to the district, to state reporting systems, to college applications. Most schools have never drawn this map. They know the front door and have no idea about the side exits.

Mapping it is unglamorous and invaluable. For each system that touches student data, write down four things: what data goes in, where it's stored, who can access it, and when it gets deleted. A spreadsheet is fine. Perfection is not the goal — visibility is.

Two things happen when you map. First, you find the surprises: the free app a teacher adopted three years ago that's still syncing rosters, the vendor whose contract expired but whose access didn't. Second, every future decision gets easier. "Should we adopt this AI tool?" becomes a question you can answer from the map instead of from a sales call.

You can't govern what you can't see. Draw the map before someone else draws it for you — auditors and attackers both love unmapped territory.

I explain frameworks; I don't give legal counsel.