Build one subscription register
Start with finance records, single sign-on applications, browser extensions, department budgets and purchase cards. Ask heads of department to confirm what is still in use. Each active tool should have a named service owner and a budget owner.
- Supplier, product and service owner
- Users, purpose and departments
- Annual cost, billing currency and payment route
- Contract start, renewal date and notice deadline
- Data categories, hosting region and DPA status
- Authentication method and technical owner
Work back from the notice deadline
The important date is often the last day to cancel, not the invoice date. Set the first review far enough ahead for consultation and procurement. A ninety-day review may suit a major platform, while a low-risk monthly tool needs less lead time.
Use staged reminders with owners, not a shared inbox. Escalate when a decision is missing rather than automatically renewing by default.
Run a proportionate review
Ask whether the tool still solves a real problem, whether usage justifies the cost and whether another approved service now covers the same need. Then review technical fit, accessibility, support, security and data protection according to risk.
A classroom quiz tool and a core student system should not face identical paperwork. Use a lighter path for low-risk processing while keeping the decision and owner visible.
Keep the DPA connected to the service
Store the signed processing agreement with the subscription record. Track its version, signing date, parties, subprocessors, transfer mechanism, deletion terms and review date. A document in a drive is hard to govern if nobody can connect it to the renewal decision.
When terms or subprocessors change, route the update to the data protection owner. Record the decision and any conditions placed on continued use.
Plan the exit before approving renewal
Confirm how the school exports data, how long access remains after cancellation and when supplier copies and backups are deleted. Identify integrations, shared links and accounts that must be removed. A renewal decision is safer when the alternative is understood.
- Decision, approvers and conditions recorded
- Purchase order or payment owner confirmed
- Next notice deadline scheduled
- DPA and security review linked
- Exit and deletion steps documented