Backup Requirements and Standards for Educational Institutions

Schools, colleges, universities, and research institutions store large volumes of student records, administrative documents, financial information, research data, email, databases, and shared files. Backup requirements for these organizations do not come from one universal education-specific law. Instead, they are shaped by privacy laws, cybersecurity rules, government guidance, and information security standards.

In the United States, FERPA sets privacy requirements for education records, while some higher education institutions must also follow the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. In the European Union, GDPR Article 32 addresses availability, recovery, and security testing. In the United Kingdom, Department for Education guidance gives schools and colleges much more specific backup recommendations, including the 3-2-1 rule, off-site copies, immutable backups, and regular restore testing.

Important: most of these laws and standards do not certify a particular backup program as “compliant.” Compliance depends on the educational institution's complete set of policies, procedures, technical controls, contracts, and staff practices. Backup software is one technical component of that larger process.

FERPA and Student Education Records

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at educational agencies and institutions to which the law applies. FERPA itself does not prescribe a specific backup schedule, storage medium, encryption algorithm, or disaster recovery procedure.

The U.S. Department of Education explicitly states that FERPA does not require educational institutions to adopt specific security controls. At the same time, schools and colleges should take appropriate steps to safeguard student records, because a data security incident can create FERPA-related privacy risks.

For backup planning, this means that an institution should treat copies of student records with the same care as the original records. Access to backup data should be limited to authorized personnel, and storage, retention, and recovery procedures should be documented.

Practical backup considerations under FERPA:

• Identify which backups contain education records or personally identifiable student information.
• Restrict access to backup repositories and recovery tools.
• Document who can restore or retrieve student records.
• Apply retention and deletion policies to backup copies as well as production systems.
• Protect backups stored with third-party service providers through appropriate contractual and technical controls.

See the U.S. Department of Education guidance on Data Security for K-12 and Higher Education.

GLBA Safeguards Rule for Higher Education

For many postsecondary institutions participating in federal student aid programs, the Gramm-Leach-Bliley Act Safeguards Rule creates more specific information security obligations. The U.S. Department of Education requires covered institutions and servicers to develop, implement, and maintain a written information security program with administrative, technical, and physical safeguards.

The Safeguards Rule is broader than backup. It includes risk assessment, access controls, protection of customer information, monitoring and testing, staff responsibilities, service-provider oversight, and incident response. Backup and recovery are relevant because the security program must address risks of destruction, loss, alteration, or compromise of student financial information.

For a higher education backup policy, consider:

• Document which systems contain student financial information and require backup.
• Protect backup data against unauthorized access and alteration.
• Monitor backup jobs and investigate failures.
• Include backup providers and storage services in third-party risk management.
• Test whether critical information can actually be restored after an incident.

GLBA should not be treated as a requirement for every K-12 school. Its education-sector relevance is primarily to covered postsecondary institutions and servicers.

NIST SP 800-53: System Backup and Recovery Controls

NIST SP 800-53 is not a general law requiring every U.S. school or university to follow NIST controls. However, it provides a useful technical benchmark for public-sector and security-conscious educational environments.

The most directly relevant controls are CP-9 System Backup and CP-10 System Recovery and Reconstitution. They address backup frequency, restoration testing, separate storage, cryptographic protection, and recovery to a known state within an organization-defined time period.

NIST-aligned backup practices include:

• Back up user-level and system-level information according to defined Recovery Point Objectives (RPOs).
• Test backup information for reliability and integrity.
• Perform sample restorations as part of contingency-plan testing.
• Keep critical backup information in separate storage.
• Use cryptographic protection where required.
• Define Recovery Time Objectives (RTOs) for restoring critical systems.

Department for Education Backup Standard

The UK Department for Education provides unusually specific guidance for schools and colleges through its digital and technology standards. The guidance says schools and colleges should develop and implement a backup plan, keep it current, test it regularly, and connect it with business continuity and disaster recovery planning.

The Department for Education recommends the 3-2-1 backup strategy:

• 3 copies of important data, including the primary copy.
• 2 separate devices or forms of storage.
• 1 copy off-site, which may include cloud storage.

Its current guidance also says schools and colleges should make backups immutable where possible, test and log backups termly or after significant changes, include restore testing, and review the overall backup plan annually.

Physical backups taken off-site should be encrypted and stored securely. The guidance also states that backups should not be taken to a staff member's home.

For a shorter explanation of the strategy, see the Department for Education 3-2-1 Backup Strategy guidance.

UK GDPR and Data Protection Act 2018

UK schools, colleges, and universities also have obligations when they process personal data. UK GDPR follows the same core security principle as EU GDPR Article 32: organizations should implement technical and organizational measures appropriate to the risk, including the ability to restore availability and access to personal data after an incident.

A backup strategy therefore needs to support not only data retention, but actual recovery. Educational institutions should also consider encryption, access restrictions, restore testing, and how backup retention interacts with data minimization and deletion policies.

GDPR Article 32

The General Data Protection Regulation (GDPR) applies to schools, universities, and other educational organizations when they process personal data within its scope.

GDPR does not prescribe a specific backup product or schedule. However, Article 32 requires appropriate technical and organizational measures and explicitly refers to:

• the confidentiality, integrity, availability, and resilience of processing systems and services;
• the ability to restore availability and access to personal data in a timely manner after a physical or technical incident;
• regular testing, assessment, and evaluation of security measures.

For educational organizations, this makes recovery capability an important part of a broader data security program. A backup process should be designed according to the sensitivity of the data, operational needs, risks, and the time within which systems need to be restored.

Practical GDPR-related backup measures may include:

• Encrypting backup copies that contain personal data where appropriate.
• Restricting access to backup repositories.
• Defining retention periods instead of keeping every version indefinitely.
• Maintaining recovery procedures for critical student and administrative systems.
• Testing restoration and documenting the results.
• Considering the location and contractual terms of cloud or off-site storage providers.

NIS2 and Educational or Research Institutions

The NIS2 Directive strengthens cybersecurity risk-management and business-continuity requirements across the EU. Its security measures include business continuity, such as backup management, disaster recovery, and crisis management.

However, NIS2 should not be described as automatically applying to every school or university in the European Union. Article 2 allows Member States to bring educational institutions within scope, particularly where they carry out critical research activities. Applicability therefore depends on the institution, its activities, and national implementation.

Where NIS2 applies, an educational or research organization should treat backup as part of its wider continuity and cyber-risk program rather than as an isolated IT task.

ISO/IEC 27001 and ISO/IEC 27002

ISO/IEC 27001:2022 is an international standard for information security management systems (ISMS). It can be used by organizations of any size and sector, including educational institutions. Certification is optional unless it is required by contract, policy, procurement rules, or another applicable obligation.

ISO/IEC 27001 does not function as an education-specific backup law. Instead, it provides a risk-based management framework, while ISO/IEC 27002 provides information security controls and implementation guidance. Backup, recovery, access control, incident response, continuity, and information protection should be considered as connected parts of the institution's ISMS.

CIS Control 11: Data Recovery

The CIS Critical Security Controls provide another practical benchmark that can be used by educational IT teams. CIS Control 11 focuses specifically on data recovery.

Its safeguards include maintaining a documented data recovery process, performing automated backups, protecting recovery data with controls equivalent to the original data, maintaining an isolated recovery copy, and testing recovery.

This makes CIS Control 11 particularly useful when an educational organization needs to convert broad legal requirements such as “availability” or “reasonable security” into concrete technical procedures.

Legal requirements vary, but the same operational principles appear repeatedly across government guidance and security frameworks. A school, college, or university backup policy should normally document the following.

• Scope. Identify student records, databases, shared files, staff documents, email, research data, websites, virtual machines, and other systems that require backup.
• Backup frequency. Define schedules according to how much recent data the institution can afford to lose.
• RPO and RTO. Define acceptable data-loss windows and target recovery times for critical systems.
• Multiple copies. Avoid relying on a single backup repository or a copy stored next to the production system.
• Off-site or isolated storage. Keep at least one recovery copy separated from the primary environment.
• Encryption and access control. Apply controls appropriate to the sensitivity of student, financial, research, or personnel data.
• Version retention. Keep enough historical versions to recover from accidental changes, corruption, or delayed discovery of an incident.
• Monitoring and logging. Record backup results and investigate failed or incomplete jobs.
• Restore testing. Test that backups can actually be restored and document the results.
• Review. Update the backup plan after infrastructure changes and review it on a regular schedule.

There is no single legally required backup frequency for every educational organization. The correct schedule depends on the type of information, how often it changes, operational importance, and the institution's RPO.

For example, a student information system or financial database that changes throughout the day may require much more frequent backups than archived teaching materials. When planning SIS backup for student information systems (SIS), institutions should consider how often records change and how quickly they need to be restored. The UK Department for Education specifically advises schools and colleges to determine backup provision according to the sensitivity and importance of data, the impact of temporary or permanent unavailability, and how long the organization could operate without it.

As a practical security benchmark, CIS Control 11 recommends automated backups at least weekly, or more frequently based on data sensitivity. Many educational systems will need a considerably shorter interval than one week.

Backup software can automate schedules, encryption, versioning, logging, and copying data to separate storage, but it cannot make a school or university compliant by itself. Educational institutions still need policies, risk assessments, access rules, staff responsibilities, retention decisions, restore tests, incident-response procedures, and appropriate agreements with service providers.

If you are choosing software to implement these technical procedures, see Backup Software for Schools, Colleges and Universities. Handy Backup can be used to automate backups of files, databases, Windows systems, email, and network computers as part of an institution's broader backup and recovery plan.

You can also learn more about automatic backup software and scheduled backup tasks.