Which policies should your madrassa review before introducing new software?

Introducing software changes everyday decisions: who can see a register, how a parent asks a question, where a teacher keeps a temporary record and what happens when someone leaves. Your policies and working instructions should describe those arrangements accurately.

Start by comparing the planned workflow with your existing documents. Keep what still works, update what changes and assign someone to resolve any gaps before launch.

This guide offers practical review questions and links to official sources. It is not a complete compliance assessment or legal advice for a particular madrassa. Data-protection references concern the UK; the DfE safeguarding guidance cited below applies to England.

1. Record what information will move and why

List the records you intend to use: for example, student details, attendance, learning progress, family contacts and fees. For each group, record its purpose, who needs access and where the existing information comes from.

Identify sensitive information separately. Health information and information revealing religious beliefs fall within special-category data. ICO: what is special-category data?.

For special-category processing, you need both an Article 6 lawful basis and an applicable Article 9 condition, with additional Data Protection Act conditions where required. Do not assume a general registration form supplies the answer for every purpose. If the correct basis or condition is unclear, resolve that with appropriate advice before processing. ICO: rules on special-category data.

Practical output: a short record of the proposed information flows and outstanding decisions, with a named person responsible for each.

2. Review your privacy information

Check that your privacy notice explains the actual purposes, lawful bases, recipients or recipient categories, retention periods or criteria, and relevant rights. Include applicable information about international transfers. The required detail depends on the processing involved. ICO: privacy information to provide.

Review the notice against the new workflow and plan how families and staff will learn about relevant changes. Explain any new purpose before using information for it. ICO: reviewing and updating privacy information.

Practical output: an updated notice where needed, an approval record and a communication plan. Our parent communication guide covers the announcement sequence.

3. Check supplier arrangements and risks

Establish the responsibilities of your madrassa and the supplier for the intended processing. Where a supplier processes personal data on your behalf as a processor, a binding written contract is required. ICO: when a processor contract is needed.

Review the processing agreement, including security, sub-processors, assistance with individuals' rights and incidents, and what happens to information when the service ends. These are among the matters covered by the ICO's contract guidance. ICO: required contract terms.

Assess whether the planned processing requires a data protection impact assessment. A DPIA is required where processing is likely to result in high risk to individuals; using new software does not, by itself, settle that assessment. Consider the specific data, people, scale and proposed uses. ICO: when a DPIA is required.

For Makatib.App, begin your supplier review with the Data Processing Agreement, sub-processor information and security and trust page.

Practical output: a recorded supplier review, agreed contractual arrangements and a documented DPIA screening decision, followed by the assessment where required.

4. Make access and working practices specific

Review how your team will approve accounts, assign classes and remove access when responsibilities change. Include cover teachers and volunteers. Confirm authorised family access individually where circumstances require it; sharing a household does not resolve every access decision.

Set working instructions for shared devices, passwords, downloaded reports and temporary records. Staff should know where to report unexpected access or a lost device and how to ask for a record to be corrected.

Practical output: agreed responsibilities and short instructions staff can follow during a teaching session.

5. Review communication and safeguarding routes

Define the channels for routine questions, fee enquiries, complaints and urgent concerns. Agree response hours with staff before publishing them to families. Make clear where a safeguarding concern goes and how to escalate if the usual contact is unavailable.

In England, DfE guidance for out-of-school settings includes religious supplementary schools and addresses safeguarding, suitable people, health and safety, and governance. Use the current guidance alongside the arrangements applicable to your own setting. DfE: out-of-school-settings safeguarding guidance.

For settings elsewhere in the UK, use the relevant national and local safeguarding guidance. Check local contacts when adapting any example policy. Keep sensitive safeguarding records within the process agreed by your safeguarding lead; a routine app message or incident entry does not replace escalation.

Practical output: clear routine and urgent contact routes, reviewed by the responsible leads and communicated to staff and families.

6. Agree the handling of old and temporary records

Identify what happens to old registers, migration spreadsheets, downloaded reports and outage records. Confirm the applicable retention arrangements before disposing of anything. Switching software is not, on its own, a reason to delete records or keep every duplicate indefinitely.

Decide who checks migration accuracy, where retained history will be accessible and who reconciles temporary entries after an outage. Explain when the previous system stops accepting new routine entries.

Practical output: a clear handover between old and new records, with owners for storage, reconciliation and any authorised disposal.

7. Approve the changes and practise them

Give each revised document an owner, version, effective date and review date. Have the appropriate person or governing body approve it under your own arrangements. Brief staff on what changes in practice and tell families what affects them.

Before launch, walk through a few scenarios: an absent pupil, an incorrect guardian link, an unanswered routine message and an unavailable system. If people disagree about what to do, resolve the process and update the wording.

Makatib.App's private transition starter pack includes draft digital working, communication and outage materials for local adaptation. Management users can find it in Admin → Resources → Transition pack. These materials support the rollout and require local review; they do not replace a madrassa's wider privacy or safeguarding policies.

Continue with Moving your madrassa to new software to put the agreed changes into a practical launch plan.

Official sources checked: 19 October 2026. The DfE source was last updated on 9 February 2026. Several linked ICO pages carry review notices following the Data (Use and Access) Act. Check the current guidance when adopting or revising your arrangements, and obtain advice on questions specific to your setting.