RCM
New educational tool
ENT, LMS, videoconferencing, AI, parent application or assessment solution.
SCHOOLS · TRAINING · MINORS
Teach with confidence.
Teach with confidence.
Protect every learner.
A school or training organization follows a person for several years: enrolment, education, evaluation, health, discipline, transportation, catering, activities, images and family exchanges. For minors, the consequences of poor dissemination or unjustified access may be particularly important.
MINORSPLATEFORMSIMAGESSCHOOL FILE
Your activity,
its real flows.
Digital tools are multiplying the players: educational platform, videoconferencing, messaging, parent application, payment, transport, canteen, video surveillance and content providers. A simple list of apps is not enough; you need to understand the accounts, data, roles, countries and parameters used.
RCM organizes processing compliance and evidence, with an approach understandable by management, teachers, administration, families and IT. The mission does not replace the analysis of all educational regulations or the educational decisions of the establishment.
Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.
WHEN TO COME
Triggers
Triggers
most common.
A mission may begin before a launch, during a negotiation or after a gap appears.
Registration and communication
Forms, documents, health, image rights, campaigns and events.
Incident or request
Account compromised, distribution of a list, photo published or request from a family.
FROM THE FIELD TO EVIDENCE
A journey
A journey
in four stages.
Decisions and limits are made visible at each stage.
Map
Application, registration, education, services, communication, archive and alumni.
Distinguish
Student, parent, manager, staff, provider and recipient.
Frame
Information, authorizations, conservation, tools, images, rights and incidents.
Forward
Train teams, explain to families and maintain controls.
SECTORAL RISKS
What the documents
What the documents
Don't always show.
These situations are points of analysis, not automatic conclusions.
Data of minors
Information, proportionality and protection must be adapted to the public.
Images and publications
A vague authorisation does not necessarily cover all media and uses.
Free platforms
Conditions, secondary uses, advertising, countries and settings should be checked.
Shared lists
Notes, absences, health or contacts may be broadcast to too large a group.
Old accounts
Access from former students, teachers or service providers must be deactivated.
Educational AI
Data sent to an AI service and assisted decisions require specific privacy framework.
OPERATIONAL CONTROLS
Measures that
Measures that
teams can apply.
Each check must have a responsible person, frequency and proportionate proof.
Tools catalog
Internal owner, supplier, data, accounts, country and purpose.
Access profiles
Separate direction, administration, teacher, health, parent, student and provider.
Image rules
Purpose, medium, duration, withdrawal and archiving clearly organized.
Duration per route
Candidates, students, evaluations, health, billing, alumni and communication.
Incident procedure
Simple reporting, immediate protection, analysis and proportionate communication.
Contextualized training
Concrete cases for teachers, administration, communication, IT and management.
DELIVERY
What RCM
What RCM
Leave it to your teams.
The final scope depends on maturity, risks and elements already available.
Education register
Teaching, administrative, security, communication and services.
Tool matrix
Platforms, contracts, data, countries, accounts and settings to correct.
Information pack
Registration, students, parents, staff, images and digital tools.
Access Matrix
Roles, permissions, approvals and review schedule.
Procedures
Rights, incidents, publications, accounts and new tools.
Training program
Sessions and materials adapted to the functions of the institution.
TWO FRAMES
GDPR and law 09-08,
GDPR and law 09-08,
I didn't confuse them.
The same activity may fall within both frameworks for different reasons.
GDPR
Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.
Law 09-08
Treatment in Morocco, rights, security and formalities of declaration or authorization.
International flows
Access, hosting, recipients, mechanism, context and additional measures.
Evidence
Contracts, registers, decisions, controls, training, incidents and actions followed.
INTERVENTION FORMATS
Start small.
Start small.
Maintain if necessary.
The amounts are confirmed after scoping; no fictitious pricing is published.
Starting point
Targeted interviews, review of available elements, major risks and sectoral roadmap.
Fixed price · after scopingPriority base
Agreed deliverables, corrections, review meeting and operational transfer to internal managers.
From — on estimateContinuous management
Volume, deadlines, meetings, controls, new projects and contract overruns.
Subscription · on quote
RESPONSIBILITIES AND LIMITS
Advise, structure
Advise, structure
and advance.
RCM provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.
- Penetration tests, forensic investigations and certifications are carried out by competent experts.
- Reserved legal consultations and litigation are directed to a lawyer.
- Sectoral regulations excluding data protection remain outside the scope unless expressly stated.
FREQUENTLY ASKED QUESTIONS
Specific responses.
Specific responses.
Contextualized decisions.
These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.
Is a general permission of right to image sufficient for all education? −
An authorization must be understandable and linked to sufficiently precise uses. Public website, social network, private space, brochure and archive do not present the same issues. The institution must also organise the withdrawal and avoid an unjustly penalising the pupil.
Can you use any app recommended by a teacher? +
Before use, the establishment must verify the purpose, the accounts created, the data sent, the supplier, the countries, the parameters and the contract. Being easy or free does not exempt you from this qualification, particularly when minors are involved.
Who can access a student’s health information? +
Only persons with a real need for care or organization must receive the necessary information. Medical detail should not circulate widely. Circuits, emergencies, documents and authorizations are separated from regular educational records.
How to respond to a parent asking for all their child's data? +
The establishment must verify the identity and status of the applicant, locate the data, protect the rights of other people and take into account the age and situation. The response is prepared in a secure and documented manner, with legal advice if a complex family situation requires it.
Can an AI platform receive students' work? +
This transfer must be evaluated before use: content, identifiers, conservation, reuse, model training, countries, rights and alternatives. RCM covers data protection analysis, not general AI Act compliance or educational evaluation of the tool.
Does RCM audit all regulatory compliance of the school? +
No. The intervention is limited to data protection and associated processes. Educational, accreditation, physical security or school organization obligations remain handled by the competent specialists and authorities.
Your sector deserves A concrete scoping.
Present your tools, data, customers, suppliers, countries and deadlines. RCM will indicate the first useful perimeter.
Scoping the mission →