Mastery Manager

Mastery Manager is a web based assessment and test management platform used by K-12 schools and districts to create, administer, score and report on student assessments. Operated from the United States, it handles personal data about pupils and educators, including standards based assessment results. Because much of this data concerns children, schools and providers must treat it with particular care under data protection law.

What Mastery Manager is

Mastery Manager lets teachers build assessments, align them to standards, administer them online or on paper, score responses and run real time reports on pupil progress. Administrators use it to track achievement across classrooms, schools and districts. The platform is delivered as a subscription service to education institutions, which act as the data controllers for the pupil information they upload and generate.

Data and cookies collected

The platform processes pupil records, educator accounts and assessment results, which together form sensitive information about, often, children. To run the authenticated service it relies on first party session and login cookies that keep users signed in and protect each session. These functional cookies are essential to the service, while any additional analytics or preference cookies would be non essential and require a separate legal basis.

GDPR and ePrivacy implications

Under the GDPR the school is the controller and the provider is a processor acting on documented instructions. The ePrivacy Directive governs the cookies set in the browser, requiring information and, for non essential cookies, consent. Because the data concerns children, the GDPR expects extra safeguards, clear information aimed at parents and pupils, and a cautious approach to any profiling or marketing, which should not occur in an assessment context.

Consent requirements

Essential session and login cookies do not need consent because they are strictly necessary to deliver the assessment platform the user has requested. Any non essential cookies, such as analytics, must not be set until the user has given informed and freely given consent. Schools should make clear to staff, parents and pupils what is collected, why, and how consent can be withdrawn, using language that is easy to understand.

International data transfers

Because Mastery Manager is hosted in the United States, pupil and educator data from the European Economic Area is transferred to a third country. These transfers can rely on the EU US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses supported by a transfer risk assessment and supplementary measures. Schools should confirm which mechanism applies before sending any pupil data abroad.

Practical compliance steps

Schools should sign a data processing agreement with the provider, complete a Data Protection Impact Assessment, and apply strict data minimisation so that only necessary pupil data is processed. Retention periods, access controls and breach procedures should be agreed in writing, and safeguards for children must be documented. Parents and pupils should receive clear privacy information, and staff should be trained on how the platform handles assessment data.