Our university has a group of parent users in Canvas who only have access to a parent orientation course. These accounts were created using the parents’ personal email addresses. Their account information is limited to basic account details such as name, personal email address, and enrollment in the orientation course. No real SIS ID is associated with these accounts.
We are preparing follow-up communication related to the recent Instructure security incident and are trying to determine whether these parent users should be included. I would be interested to hear how other institutions are handling similar accounts:
- Are you including similar parent accounts in your communications?
- If yes, are you sending these users the same message as faculty, students, and employees, or a shorter, tailored notice?
- How are you balancing transparency with the risk of causing unnecessary concern when the exposed information is limited?
I understand that notification decisions may depend on institutional policy, legal guidance, and the specific data involved. I am mainly looking to understand how other Canvas administrators and institutions are approaching this population.
