Public sector & education
Education data backup, from secondary school to university
Mindtime copies your Google Workspace or Microsoft 365 tenant, servers, research storage and staff laptops to its own Tier III data centres in the Netherlands and Germany, as immutable backups with an air-gapped copy.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
Schools and universities need offsite backups that ransomware can't touch, because student records, exam work and research data must stay available for years. The sector's Normenkader IBP includes a norm on backup and recovery, and funded universities are due to come under the Cyberbeveiligingswet. Mindtime keeps immutable, air-gapped copies in its own Dutch and German data centres.
What's at stake
The data schools and universities can't afford to lose
Student records
Enrolment, absence and results data in the student information system follow a pupil long after they leave. Records of absence and of enrolment and deregistration must be kept for five years after a pupil leaves.
Exam files and graded work
School exam results, theses and assessed assignments are the evidence behind a diploma. When a student appeals a grade, the school has to show what was handed in and how it was marked.
Research data
Universities and universities of applied sciences hold raw and processed research data that underpins published results. The research integrity code expects both versions to be kept for a period that suits the discipline.
Rules and obligations
What the rules ask of schools and universities
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Funded higher education is joining the Cyberbeveiligingswet
Education is not a NIS2 sector by default, but the Ministry of OCW intends to designate funded universities and universities of applied sciences under the Cyberbeveiligingswet. According to SURF, that designation is expected in March 2027, when most obligations start. [1]
Normenkader IBP: backup and recovery procedures
The information security and privacy framework for primary and secondary education includes norm 13.2, 'Procedures voor back-up en herstel'. From 1 January 2027 school boards must know where they stand through a self-evaluation and have a plan to reach maturity level 3. [5]
Five years for absence and enrolment records
Kennisnet's retention guide for schools lists statutory periods for pupil absence and for enrolment and deregistration records: both are kept for five years after the pupil leaves. Financial records follow the seven-year fiscal period. [6]
Archive selection list for universities
Under the Archiefwet, the Ministry of OCW adopted the Selectielijst Universiteiten en Universitair Medische Centra 2020, in force since 31 January 2020. It sets which university records are destroyed and which are kept permanently. [7]
Research integrity: keep raw and processed data
Standard 24 of the Netherlands Code of Conduct for Research Integrity (2018) asks researchers to manage collected data carefully and keep both raw and processed versions for a period appropriate to the discipline and method. [8]
When it goes wrong
Exam week and a compromised admin account
Illustrative example: during exam week, an attacker takes over an administrator account at a secondary school group and deletes a batch of shared drives, including teachers' folders with graded coursework. Google's own recovery window is short and the deleted data was never in Vault. The IT team restores the shared drives from Mindtime's immutable backup, held outside the school's Google tenant, and checks the restored files with the exam secretary. The school then reviews whether the incident has to be reported to the Autoriteit Persoonsgegevens.
How Mindtime protects it
Backup for schools and universities, workload by workload
- Google Workspace backupMany Dutch schools work in Google Workspace for Education, and Google's own recovery options are limited in time.
- Microsoft 365 backupStaff mail and shared course material in Microsoft 365 need a copy outside the tenant an attacker might take over.
- Laptop and endpoint backupTeachers and researchers keep work on laptops that aren't always synced to a central store.
- Linux server backupResearch computing and departmental services frequently run on Linux servers that fall outside central IT backups.
- NAS backupDepartments and smaller schools store media, research data and archives on a Synology or QNAP NAS.
- NIS2 ComplianceFunded universities and universities of applied sciences are expected to be designated under the Cyberbeveiligingswet.
The software you use, and what we protect around it
| Magister (student information system, secondary education) | Magister is a cloud service from Schoologica. Check its export and retention terms; Mindtime protects the Microsoft 365 or Google Workspace data, file shares and laptops around it. |
|---|---|
| Somtoday (student information system, secondary education) | Somtoday, from Topicus, is also delivered as an online service, so the supplier holds the pupil administration. Mindtime backs up what the school keeps itself: mail, shared drives, servers and staff devices. |
| Google Workspace for Education | Gmail, Drive and shared drives for staff and students are backed up to Mindtime's data centres in the Netherlands and Germany, with a 7-day free trial. |
| Microsoft 365 for education | Exchange Online mailboxes, OneDrive and SharePoint sites are backed up independently of Microsoft's own retention. |
| Research storage on Linux servers and NAS | Research groups often keep datasets on their own Linux servers or a Synology or QNAP NAS. Mindtime backs these up off-site, with every job checked. |
Google Workspace
Google Workspace backup for schools
Many Dutch schools run lessons, coursework and staff communication in Google Workspace for Education: Gmail, Drive, shared drives for departments and Classroom files stored in Drive. The education sector agreed privacy measures with Google, but those agreements don't give you a backup.
- SIVON and SURF negotiated privacy measures with Google after a 2021 DPIA found high risks. Schools may keep using Google Workspace for Education, provided they apply the agreed settings, accept Google's education terms and carry out their own local DPIA.
- Files moved to Drive's trash are deleted forever after 30 days, and administrators can recover items only within 25 days after a user empties the trash. When an account is deleted, the window for recovering its Drive files is 20 days.
- Google Vault is built for retention and eDiscovery, and Google states that 'Vault isn't a data archive'. When a user or a required licence is removed, the data can be purged irreversibly, which matters every summer when leavers' accounts are cleaned up.
- Mindtime backs up Google Workspace to its own Tier III data centres in the Netherlands and Germany, immutable and with an air-gapped copy. Try it free for 7 days.
Before you switch
What schools and universities ask us first
Google and Microsoft already look after our data.
They keep their platforms available, but deleted files, a wiped account or data encrypted through a compromised admin login can only be restored within their own time limits. Mindtime keeps an independent, immutable copy outside your tenant, in its own data centres in the Netherlands and Germany, so restoring doesn't depend on those limits.
Our budget goes to teaching, not to IT.
Start small and see what it involves: Mindtime offers a free 15-minute demo and a 7-day free trial for Microsoft 365 and Google Workspace backup. Many schools buy IT through a service provider; those partners can run Mindtime from a multi-tenant console with pay-as-you-grow billing.
Student data must stay in Europe.
It does with Mindtime. Backups are stored only in Mindtime's own Tier III data centres in the Netherlands and Germany, and every contract includes a data processing agreement. Mindtime is audited against ISO 27001 and NEN 7510.
FAQ
Questions about backup for schools and universities
Does the Cyberbeveiligingswet apply to schools?
Education is not one of the sectors in the NIS2 annexes; the directive lets member states add education institutions. The Netherlands is using that option for funded universities and universities of applied sciences, through a sector-specific arrangement from the Ministry of OCW. Primary and secondary schools are not part of that plan, although the Normenkader IBP still asks them for backup and recovery procedures.
What does the Normenkader IBP expect from backups?
Norm 13.2 of the framework for primary and secondary education covers procedures for backup and recovery. Your school board should be able to show that backups are made, protected and tested. Mindtime checks every backup job, monitors around the clock and keeps an immutable, air-gapped copy, which gives you evidence for the self-evaluation due from 1 January 2027.
How long should we keep pupil records?
It depends on the record. Absence data and enrolment and deregistration records must be kept for five years after a pupil leaves, and financial records for seven years. Other data has shorter periods. Kennisnet publishes a retention overview for schools; a backup helps you meet those periods after an incident, while your own deletion policy decides when records go.
Can Mindtime back up research data outside Microsoft 365 or Google?
Yes. Mindtime backs up Linux servers, Synology and QNAP NAS devices, databases such as PostgreSQL, MySQL and SQL Server, and workloads in AWS, Azure and Google Cloud. Research groups can keep an off-site, immutable copy in the Netherlands or Germany without moving their working data elsewhere.
Can our IT partner manage backups for several schools?
Yes. School groups and education IT providers use Mindtime's multi-tenant console to manage each school as a separate tenant. REST APIs and hooks connect it to their own tools, billing grows with use and white-label options are available. Support is in Dutch, German or English, from people rather than chatbots.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.