private uploads

I know private uploads been done-to-death in the drupal forums, but I do need fresh, clear advice from other school website maintainers.

For a school website, where many of the uploaded media files will contain images and work of pupils, it is very desirable (almost necessary) to make sure they are protected so that only users with accounts can access them (meaning that urls pointing directly to files should throw a 403 error for anyone not logged into the site).