A school operating concept defining a repeatable routine or artifact used to deliver instruction and support consistently. It specifies steps, roles, and documentation that make practice measurable and easier to review. It does not ensure quality without correct execution and follow-through on identified adjustments. It supports alignment and reliability by reducing avoidable variation in high-frequency school processes. The concept is generally stable, though tools and expectations evolve over time.

Principle

Translate strategic privacy objectives into reproducible, auditable procedures that assign roles, inputs, outputs, decision gates, and recordkeeping so actions affecting personal data are consistent and verifiable.

Demonstration

A protocol that prescribes how to process a parental request to access their child's records: verify identity with two factors, check legal basis, extract relevant records from the SIS, redact unrelated data, log the request and delivery, and schedule record of the action for audit.

Misapplication

Applying a protocol designed for one jurisdiction or data type to a different legal context or dataset without review, or rigidly following steps when a reasonable exception should be made, which creates legal risk or operational failures.

Consequence

Correct protocols ensure repeatable, defensible handling of privacy tasks, reduce human error, and provide evidence for audits and incident investigations affecting the SIS.

Reversal

Having protocols without a guiding privacy plan leads to mechanically compliant but misaligned procedures; conversely, having a plan without operational protocols leaves staff without practical means to comply.

Boundary

Protocols are procedural and operational; they do not themselves establish policy or legal obligations but must conform to them. Protocols are not system configurations, though they may require specific system actions.

Semantic Tension

Near the meanings of policies, runbooks, and standard operating procedures; protocols are narrower than policies (which state commitments) and more formal than informal how‑to notes, focusing specifically on privacy controls.

Synthesis

A Privacy Protocol is the procedural bridge between privacy strategy and daily operations: it prescribes who does what, when, and how so that privacy protections in SIS contexts are consistently executed, recorded, and defensible.