Which statement best describes the Data Privacy Act's handling of student records in schools?

• A. It regulates the collection and sharing of personal data.
• B. It regulates collection, storage, processing, and sharing of personal data.
• C. It regulates only the retention period for records.
• D. It has no bearing on student privacy.

Answer: (B)

The Data Privacy Act governs the entire lifecycle of personal data in schools. Student records contain personal information, and how a school collects, stores, processes, and shares that data determines privacy protection. The most accurate description is that the Act regulates collection, storage, processing, and sharing of personal data—the full spectrum of how records are handled, from initial capture to any disclosure or disposal. This broad scope is why schools must obtain appropriate consent, implement security measures, ensure data accuracy, and follow retention and destruction rules. The other options are narrower or incorrect: limiting to collection and sharing misses storage and processing; focusing only on retention ignores how data is used and disclosed; saying there’s no bearing contradicts the Act’s purpose to protect student privacy.