Public sector & education
Backup for primary schools that keeps pupil files within reach
Your pupil administration usually lives with the software supplier, but group plans, parent meeting notes and staff mail live in your own Microsoft 365 or Google account. Mindtime keeps immutable copies of that data, with an air-gapped copy, in its own data centres in the Netherlands and Germany.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
Primary schools need a backup outside their own Microsoft 365 or Google account, because the files around the pupil administration (group plans, parent meeting notes, reports for the next school) are often not stored anywhere else. Mindtime keeps immutable, checked copies in its own Dutch and German data centres, separate from your tenant.
What's at stake
The data primary schools can't afford to lose
Pupil files and parent meeting notes
A pupil file holds more than marks: observations, notes from conversations with parents and health information needed for extra support. Much of that is written in Word or Docs and saved in a teacher's OneDrive or a shared Drive, not in the pupil administration system.
The educational report for the next school
When a child moves to another school, or on to secondary school after group 8, the school sends an onderwijskundig rapport with results, development, behaviour and absence. Without the underlying records, nobody can put that report together properly.
Absence and enrolment records
Registration, deregistration and absence data have to stay available for five years after a pupil leaves. A wiped spreadsheet or a lost shared folder with older registrations leaves the school unable to answer questions from parents or the attendance officer.
Rules and obligations
What the rules ask of primary schools
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Retention: two years as a rule, longer for some records
According to Rijksoverheid, most pupil data may be kept for two years after a child leaves. Enrolment, deregistration and absence data are kept for five years, and data about a referral to special education for three years. [1]
An onderwijskundig rapport on every transfer
When a pupil changes school, the school draws up an educational report on results, development, behaviour and absence. For the move to secondary school it includes the transition test result and the school's advice. Parents may read it and add their view. [2]
Limited access to pupil data, with logging
The Autoriteit Persoonsgegevens expects schools to give no more people access to pupil data than the purpose requires and to log user activity in their systems. For primary pupils, parents with legal authority exercise the right of access. [3]
Sector deadline: digitally secure by 2030
School boards agreed with the Ministry of OCW to know their position against the Normenkader IBP from 2027. By 2030 at the latest, all schools must meet those standards, which include a norm on backup and recovery procedures. [4]
Outside the Cyberbeveiligingswet
Education is not a sector in the Dutch Cyberbeveiligingswet, which implements NIS2. The Ministry of OCW is working on a separate arrangement for funded universities and universities of applied sciences only, so primary schools are not covered by it. [7]
When it goes wrong
A headteacher's account taken over in the spring term
Illustrative example: a phishing e-mail gives an attacker access to a headteacher's Microsoft 365 account at a school board running several primary schools. The attacker deletes the shared folder with group plans and the notes from this year's parent conversations, just before the group 8 advice is finalised. The pupil administration, hosted by its supplier, is untouched, but the working documents are gone from the tenant. The board's IT partner restores the folder from Mindtime's immutable copy, held outside the school's account, and the data protection officer decides whether to report the incident to the Autoriteit Persoonsgegevens.
How Mindtime protects it
Backup for primary schools, workload by workload
- Microsoft 365 backupMany school boards run staff mail and shared folders in Microsoft 365, where a compromised account can delete files across the tenant.
- Google Workspace backupPrimary schools on Google Workspace for Education keep group plans and staff documents in Drive and shared drives.
- Laptop and endpoint backupTeachers prepare lessons and write reports on school laptops, not all of which sync everything to the cloud.
- NAS backupA Synology or QNAP in the staff room often holds photos, scans and older records that exist nowhere else.
The software you use, and what we protect around it
| ParnasSys (pupil administration and tracking, Topicus Education) | ParnasSys is used through the browser and hosted by its supplier. Check its export and retention terms; Mindtime protects the mail, Drive or OneDrive files and laptops around it. |
|---|---|
| ESIS (pupil administration and tracking, Rovict) | ESIS also runs as a browser-based service. Mindtime does not back it up directly; it backs up the documents, reports and staff devices the school keeps itself. |
| Parro (parent communication app) | Messages to parents sit in the supplier's platform. Agreements made with parents that end up in mail or a shared folder are covered by Mindtime's Microsoft 365 or Google Workspace backup. |
| Google Workspace for Education or Microsoft 365 | Staff mailboxes, shared drives, OneDrive and SharePoint are backed up to Mindtime's own data centres in the Netherlands and Germany, with a 7-day free trial. |
| School NAS (Synology or QNAP) | Some schools keep photos of school events, scanned files and older archives on a NAS in the building. Mindtime copies it off-site, so a fire or ransomware doesn't take the only copy. |
Before you switch
What primary schools ask us first
Our pupil administration is in the cloud. Isn't that backed up already?
Your supplier looks after its own platform, on terms it sets. The files your staff create around it, in mailboxes, OneDrive or shared drives, remain your responsibility. Mindtime keeps an independent, immutable copy of those in its own Tier III data centres in the Netherlands and Germany, with a data processing agreement in every contract.
We only have an ICT coordinator for a few hours a week.
That's typical, and it's why there is little to do day to day. Mindtime checks every backup job and monitors around the clock, and when you need help you speak to a person in Dutch, German or English. A free 15-minute demo shows what setting it up involves.
Our school board's IT partner handles all of this.
Good, then they can run Mindtime for you. IT partners manage each school or board as a separate tenant in a multi-tenant console, with pay-as-you-grow billing and white-label options. It's worth asking your partner where your backups are stored now and whether they are immutable.
FAQ
Questions about backup for primary schools
How long does a primary school keep pupil data?
Most pupil data can be kept for two years after a child leaves. Enrolment, deregistration and absence data stay for five years, and data on a referral to special education for three years. Your retention policy decides when records are deleted; a backup makes sure they are still there, and readable, until then.
Does the Cyberbeveiligingswet apply to our school board?
No. Education is not one of the sectors covered by the Dutch implementation of NIS2, and the arrangement the Ministry of OCW is preparing is for funded higher education. Primary school boards still have work to do on security, though: the sector has agreed that all schools meet the Normenkader IBP by 2030, including its norm on backup and recovery.
What should we show for the IBP self-evaluation on backups?
Be ready to explain what is backed up, where the copies are kept, who can reach them and when a restore was last tested. Mindtime checks every backup job, keeps immutable and air-gapped copies outside your tenant and requires MFA for admin actions. Those facts give your IBP officer something concrete to record in the self-evaluation.
Do we have to report a hacked account to the Autoriteit Persoonsgegevens?
Possibly. If pupil or parent data was exposed, lost or made unavailable, the school may have to report the breach to the AP within 72 hours, and sometimes inform the parents. Keep an internal register of every breach either way. Being able to restore the data quickly from a clean backup limits the damage you need to describe.
Can staff laptops be included as well as mail and files?
Yes. Mindtime backs up Windows, macOS and Linux laptops alongside Microsoft 365 or Google Workspace, so a lost or stolen school laptop doesn't take a teacher's unsynced reports with it. Data is encrypted in transit with AES-256 and stored only in Mindtime's own data centres in the Netherlands and Germany.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.