Most sensitive pupil data now sits in cloud platforms. A teacher taking the register or entering assessment scores opens Arbor or Bromcom in a browser, and a safeguarding lead logging a concern opens CPOMS. Those systems are encrypted and access controlled.
The bigger risk sits on the school laptop, because copies of that data end up there in the ordinary course of work. Emails are cached, spreadsheets exported, files saved for offline working and passwords remembered by the browser. A signed-in session times out on its own. None of those copies do. They stay on the laptop until someone removes them, and in schools the laptop often goes home when lessons finish.
To find out how often that happens, ASUS Education commissioned YouGov to survey 1,013 UK teachers, weighted to represent the profession.
What do teachers keep on their devices?
One in six teachers have downloaded a file from their school’s management information system and saved it on their school laptop. Across the UK workforce, that is more than 100,000 people carrying a copy of pupil records that will never time out.
More broadly, eight in ten teachers keep pupil data on their school laptop or stay logged in to systems that hold it. Those figures count live sessions as well as stored files. Assessment data is the most common, at 55%. Two in five have emails that name pupils. A third have safeguarding or child protection records, and three in ten hold records for pupils with special educational needs.
And the devices travel beyond the school gate. Almost six in ten teachers (58%) have taken a school device home to work on in the evening or at weekends in the past year. Seven in ten (72%) have done at least one thing a security team would rather they hadn’t. One in six have left a device unlocked in a shared area at school, and the same proportion have stepped away while signed in to a cloud system. Others have plugged in a personal USB stick (13%) or let someone else, including family members, use the device (11%). Marking, reports and lesson planning follow the teacher home, and so does the laptop.
Can schools reach a lost laptop?
Ask teachers whether their school could lock a lost laptop from a distance and just 29% say yes. For wiping one, it is 28%. A quarter report encrypted storage and one in five central control of USB ports. A further one in five don’t know what protection their school has at all.
That matters most for downloaded files. A school can end a browser session by resetting the teacher’s password or signing them out centrally. It can’t do that to a spreadsheet saved on the laptop. The only way to remove it remotely is a wipe. The risk is that teachers assume someone, somewhere, could do that if the laptop went missing. Often, no one can.
Two in five senior leaders (39%) say their school can lock a device remotely, against a quarter (24%) of classroom teachers. That may reflect a real difference in provision or simply in awareness, and our survey can’t say which.
Three-quarters of teachers (76%) rate remote lock and remote wipe as a top or high priority for their school, against the three in ten who say their school has them.
Why do lost devices matter?
Figures from the Information Commissioner’s Office (ICO), the UK’s data protection regulator, record 115 reports of lost or stolen devices from the education and childcare sector between 2023 and 2025, a small share of the incidents schools report. But they tend to be large. Three quarters affected 10 or more people and a third more than 100.
A lost laptop exposes whatever was cached, synced or downloaded onto it. Under UK data protection law, a school has 72 hours to report a breach to the ICO if it poses a risk to the people affected. An encrypted laptop may not need reporting at all. One with a spreadsheet of safeguarding records on an unencrypted drive almost certainly does.
The Department for Education (DfE) expects every school in England to meet its digital and technology standards by 2030. They include keeping a hardware register, controlling removable media and being able to lock and wipe portable devices. Statutory safeguarding guidance requires safeguarding records to be stored securely, so a laptop holding child protection notes is a safeguarding matter as much as an IT one.
Fewer than half of teachers (46%) have heard of the DfE’s cyber security standards. The same proportion have had device security training in the past year, and 48% have seen written guidance on what they may store.
What should schools do?
Most of the fix is basic hygiene. The school IT manager should be able to say who has each laptop and where it was last seen, and lock or wipe it from there. Personal USB sticks can be blocked unless someone has a reason to use one.
Teachers should have in writing who to ring on a Sunday evening when the laptop isn’t in the bag, and what they may save to the machine. A downloaded spreadsheet stays on the laptop long after the same data viewed in a browser has gone.
Anyone who manages laptops for a mobile workforce will know this problem. Schools have a harder version of it. Their laptops are used by teachers, not security staff, and the files on them are about children.
The question every school needs to ask is simple. If a teacher’s laptop went missing tonight, what could the school do about it by morning?
The full report, Keeping Control, Protecting Data, includes a ten-question checklist for schools and trusts.
_________
About Nick Mitchinson
Nick Mitchinson leads commercial marketing for ASUS Education in the UK. He is invested in how technology can support teachers and pupils, in classroom-ready hardware that works for every child, and in keeping the pupil data on school devices secure. Connect at linkedin.com/in/nmitchinson
Join our LinkedIn group Information Security Community!
