This is an issue of great concern to me now that most schools are enabling external access of one kind or another. My current school has all the students in one year with the same simple short password, meaning that any student and by extension any parent can log in as any child from outside school. This seems to be both a GDPR failing and safe guarding. I am currently losing the battle (and the will to live) on this issue. I have been asked to provide examples of best practice from other schools and prove that there is a risk, I've tried to explain that's not how the law works to no avail.
