ADEK School Digital Policy: what it asks of an Abu Dhabi school’s IT team

What the ADEK School Digital Policy is, and when it applies

The ADEK School Digital Policy is the Abu Dhabi Department of Education and Knowledge’s rulebook for how private and charter schools plan, secure and govern their technology. ADEK says it “sets out the basic requirements for schools” on a digital strategy, teaching about digital safety and the secure use of digital technology. The last of these is IT’s.

Version

1.1, dated September 2024. Version 1.0 was issued in January 2024.

Effective from

Academic year 2024/25, Fall term (clause 9.1).

Full compliance from

Academic year 2025/26, Fall term (clause 9.1).

Scope

Private and charter schools in Abu Dhabi. Any circular issued before the policy, or issued later specifically for charter schools, supersedes it.

Penalties

Clause 9.2 makes non-compliance subject to “legal accountability” and penalties under ADEK’s regulations and federal law, with no amounts stated.

The timetable matches ADEK’s wider update of 5 November 2024: the Abu Dhabi Media Office release, covering 39 updated private school policies and 27 new early education policies, said full compliance with most of them was expected by the next academic year.

The seven documents clause 1.1 asks a school to publish

Each goes on the school website in Arabic and English, or the language of instruction. In our reading, the four marked IT are mostly technical drafting.

1. Digital strategy covering five years (clause 2.1).
2. Responsible usage policies for students, parents, staff and visitors (clause 4.1).
3. IT: a framework for selecting external providers and products (clause 5.5; the English PDF’s clause 1.1 says “5.4”, but the section is 5.5, as the Arabic text has it).
4. IT: the Data and Cybersecurity Infrastructure document (clause 6.1).
5. IT: a response plan for cybersecurity incidents (clause 6.6).
6. IT, with leadership: the school data protection plan and policy (section 7).
7. Digital media and social media policies (section 8).

Policy version checked: version 1.1 (September 2024), still listed on ADEK’s health, safety and wellbeing policy page on 8 October 2026. This guide summarises the policy with clause numbers and short quotes; the PDF on adek.gov.ae is the text that counts. It is a planning guide for IT teams, not legal advice. PRO TECHnology is not affiliated with or endorsed by ADEK.

Which clauses belong to IT, and which do not

ADEK gives oversight to a Digital Wellbeing Committee or Lead (clause 2.2), which develops the strategy, reviews it every year and consults people such as “the Digital Officer, Head of IT”. IT supplies most of the review’s evidence.

This split is PRO TECHnology’s planning reading. ADEK assigns oversight to the Digital Wellbeing Committee or Lead, not clauses to departments.

School-issued, shared and personal devices

Clause 5.1 says devices issued to members of the school community must have “appropriate security features”. Where staff can reach school data or systems from other devices, or the school runs Bring Your Own Device for staff or students, the school must define and implement digital safety precautions, with a minimum device specification and antivirus requirements given as examples.

Clause 6.1 item 4 sets the baseline for every school-managed device: up-to-date anti-virus or anti-malware software, hard disk encryption and regular security patching. Clause 6.2 adds maintenance of operating systems, security systems and software, plus regular testing. Clause 5.3 asks for distance learning measures for emergencies such as a temporary closure, which for IT means accounts and devices that work away from campus.

Three records cover most of what the annual review will ask about devices:

• Keep a device list with encryption, anti-malware and patch status for each school-managed device.
• Write the BYOD precautions down: minimum specification, antivirus, and which school systems a personal device may reach.
• Cover shared devices in the responsible usage policy, as clause 4.1 item 1 requires (“including shared devices”).

An endpoint management console is one way to produce encryption and patch evidence across a mixed fleet; our guide to how mobile device management (MDM) and unified endpoint management (UEM) tools manage Macs, iPads and Windows laptops explains those tools.

Lockable charging trolleys for shared class sets help with custody of shared devices, but no ADEK clause requires them: the physical security item, clause 6.1 item 9, concerns servers, networking equipment and other critical infrastructure.

Sign-in, filtering and the school network

Access control and learning apps

Clause 6.1 item 1 asks for multi-factor authentication “across critical services” and role-based access control. Clause 6.1 item 13 covers the cloud: providers with “stringent security standards”, proper configuration and access controls, software as a service (SaaS) integrated with school identity services “where possible”, and SaaS Security Posture Management, which the policy defines as an automated tool that finds misconfigurations, unnecessary accounts and excessive permissions. Clause 6.3 asks for safeguards such as single sign-on for external learning applications.

Together they point towards a single school identity that learning apps use wherever possible. The policy does not say which services are critical, so the Data and Cybersecurity Infrastructure document should name them. Creative apps the school pays for are part of the picture: Adobe’s K-12 privacy page says schools, not Adobe, set up and manage student accounts, and our page on Adobe Education licences signed in through the school’s own identity covers how that works.

Responsible use, filtering and monitoring

Clause 4.1 item 2(a) tells schools to restrict students’ use of Virtual Private Networks on school premises or through school networks, unless explicitly authorised for specific educational or administrative purposes. Clause 4.1 item 4 asks for rules on setting and sharing passwords for school accounts.

Clause 4.2 item 2(b) requires “appropriate filtering and monitoring systems” for student internet use on school devices and systems, and item 2(c) regular analysis of internet usage and web filter violations to spot adverse trends.

Clause 6.1 item 3 lists the network controls, including next generation firewalls and intrusion detection or prevention systems, enforced web filtering, detection of infected machines, identity-based firewalls and regular audit of network traffic.

ADEK’s backup clauses: vaulted, offline and kept apart from the network

Four clauses deal with backups, and ADEK’s own wording is the safest guide to the evidence a school should keep. Clause 6.5 covers schools with onsite data storage and backups of “important information, software, and configuration settings”, with frequency and retention set by the ADEK School Records Policy.

ADEK does not define “vaulted”, and this policy sets no backup frequency of its own; it defers to the Records Policy. The method is the school’s to choose, write down and show working. Our backup guide covers the 3-2-1 rule and how to test a restore, and the Kanguru Defender HDD350 page describes an encrypted hard drive as the offline copy in a backup rotation.

Data classification, data loss prevention and the data protection plan

Clause 6.1 item 2 asks for encryption of data in transit and at rest. Clause 6.1 item 6 asks for data classification across school and student data, and data loss prevention tools to stop leaks and exfiltration.

Section 7 turns this into documents. The clause 7.1 Data Protection Policy must comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and set out at least:

• The types of personal information the school may collect.
• Consent procedures: consent must be freely given, specific, informed and unambiguous, and can be withdrawn at any time.
• The conditions for sharing personal information, for example with ADEK.
• A non-disclosure agreement in contractor agreements under which personal data “cannot be shared within or outside the country for any purposes, without the explicit consent of ADEK” (clause 7.1(3)(a)).

Clause 7.3 asks for a data protection plan, reviewed every year, recording classification methods, authorisation levels, protections against cyber and other threats, and restore procedures.

For IT, that means a classification scheme systems actually apply, a register of where student data is stored, and contractor agreements checked for the non-disclosure clause. Before relying on any reading of that clause for a particular cloud service, ask ADEK how it applies. Where student data has to leave the network on a drive, encrypt the drive; the comparison of hardware and software encryption on our Kanguru page explains the options.

Choosing IT and edtech vendors under clause 5.5

Clause 5.5 asks every school for a third-party risk assessment framework for selecting external IT providers and products, including learning application providers and open-source applications. Its eight minimum criteria turn naturally into supplier questions.

Clause 5.5(2) asks the school to tell each vendor that it is subject to the Personal Data Protection Law and ADEK’s terms and policies. Clause 6.1 item 15 asks schools to vet and monitor third-party educational technology vendors against security standards, so for those vendors the assessment recurs rather than being a one-off.

Incident response, logs and the tabletop exercise

The policy uses two kinds of incident. A digital incident under clause 4.3 is misuse by a member of the school community, such as cyberbullying. It is handled under the school’s behaviour, protection and staff policies, recorded and signed by the Principal, and reported to ADEK where required. A cybersecurity incident is a breach that threatens the confidentiality, integrity or availability of systems or sensitive data. The second belongs to IT.

Clause 6.6 asks for response and business continuity plans that guide staff through a cybersecurity incident, including how it is reported to the school leadership team and to ADEK and how operations continue. Clause 6.6(1) says schools shall not communicate any cybersecurity incident to external parties “except for the service provider involved and ADEK”. Clause 6.6(2) requires adherence to applicable laws and to policies set by the Department of Government Enablement and other UAE authorities, including Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes.

Clause 6.1 item 8 asks for a regularly updated incident response plan and a tabletop cyber-attack simulation, a guided walk-through of an imagined attack, with school management taking part. Clause 6.1 item 11 asks for real-time monitoring and detailed logs for auditing and analysis.

Points to settle before anything happens

• Who reports to ADEK: the policy does not say, though the clause 2.3 liaison is an obvious candidate.
• Which service providers may be told about an incident, and who speaks to them.
• Where logs are kept, for how long, and who can read them.
• The date of the last tabletop exercise and which members of management took part.
• How teaching continues while systems are down (clause 6.6, with the distance learning measures in 5.3).

Evidence for the annual review, and what the policy does not prescribe

Clause 2.2 makes the review annual, so keep dated evidence in one place. A workable pack for the IT clauses holds:

1. The seven clause 1.1 documents as published, in Arabic and English or the language of instruction, with their publication dates.
2. A device inventory showing encryption, anti-malware and patch status (clauses 5.1, 6.1 item 4, 6.2). Our guide to keeping a device and software inventory that stays current covers the method.
3. Backup job logs, the location of the offline copy and the last restore-test record (clauses 6.1 item 5, 6.5, 7.3, 2.2(2)(c)).
4. The web filtering policy, dated analysis of filter violations and the published student VPN rule (clauses 4.1 and 4.2).
5. Multi-factor coverage of critical services and the list of cloud apps with their sign-in method (clauses 6.1 items 1 and 13, 6.3).
6. Vendor assessments against clause 5.5 criteria (a) to (h), with re-check dates (clause 6.1 item 15).
7. The incident response plan, the tabletop exercise record and the log retention settings (clauses 6.1 items 8 and 11, 6.6).
8. Training records for staff and students (clauses 3.2 and 6.1 item 7).
9. The data protection plan with its annual review date, and the contractor non-disclosure clauses (clauses 7.1 and 7.3).

The policy names no products for its IT controls; the only products it names are social media and messaging apps, given as examples. Clause 6.1 item 10 refers to “local and international data protection regulations and standards” without listing them, and the purpose statement refers to “the requirements of the Monitoring and Control Center” without saying what they are or which body sets them, so ask ADEK what applies.

Where PRO TECHnology can help with the IT clauses

PRO TECHnology is a Dubai-based IT supplier, not an auditor. The table maps clauses to what the Enterprise IT division supplies, with the limits of each.

PRO TECHnology is FileWave’s distributor and partner for the Middle East, and FileWave’s 1 July 2026 announcement describes the partnership as covering sales, deployment and local support across the region. To see how the console reports on your devices, book a demonstration from the FileWave page, at the Business Bay showroom or at your school. For the other practices, see the Enterprise IT division.

Sources

The policy text was read in ADEK’s English and Arabic PDFs (version 1.1, September 2024), downloaded and checked against ADEK’s policy page on 8 October 2026; the other sources were opened the same day, with the two UAE legislation pages and Adobe’s K-12 page read through Internet Archive copies from August to October 2026 because the live sites block automated access. The KHDA answer relies on a Gulf News report of 1 October 2026, listed below, which is a press report rather than a KHDA document.

• ADEK: School Digital Policy, version 1.1, September 2024 (English PDF)
• ADEK: School Digital Policy, version 1.1 (Arabic PDF)
• ADEK: school policies on health, safety and wellbeing (policy listing)
• Abu Dhabi Media Office: ADEK launches new and updated policies, 5 November 2024
• UAE Legislation: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
• UAE Legislation: Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes
• FileWave knowledge base: getting started with FileVault in FileWave
• FileWave knowledge base: BitLocker management for Windows 10 and 11
• FileWave knowledge base: manage BYOD with Apple User Enrollment
• FileWave knowledge base: manage OS software updates with FileWave
• FileWave: PRO TECHnology and FileWave expand unified endpoint management across the Middle East, 1 July 2026
• Adobe: K-12 student privacy page
• Gulf News: KHDA to issue clear rules on AI, mobile phone use for students, 1 October 2026 (press report)

Frequently asked questions