School software and the GDPR: the questions to settle first

Processing on behalf, responsibility and instructions

The processor contract under Article 28 GDPR is not a form to fill in but the description of a relationship. The school remains the controller and determines which data is processed for what purpose; the provider processes it solely on instructions and never for its own purposes. The agreement also covers duration and subject matter, the categories of people affected, the protective measures, support with access requests, the reporting of incidents, the handling of sub-processors, and what becomes of the data once the contract ends. Outside the EU and the UK the article number changes but the substance rarely does, because almost every privacy regime needs some way to bind a vendor who holds pupil data. That same division of roles explains why a grade list on a private laptop is the school's problem: the school stays responsible, yet on someone else's device it can neither limit access nor prove what happened to the file.

Grades, sick notes and the special categories

Not all school data is equally sensitive, and the line between them is drawn in similar places almost everywhere. In the EU and the UK the reason given for a sick note is health data and therefore falls into the special categories under Article 9 GDPR, for which stricter requirements apply. In practice this can be defused: for an absence record it is usually enough to know that the absence was due to illness, and a reason can stay voluntary. Grades and assessments do not fall under Article 9, which does not make them harmless: they describe performance over years and shape transitions and qualifications, which is why systems that have no Article 9 at all still protect them – United States federal law treats them as education records under FERPA, with its own consent and disclosure rules. Both point to the same conclusion wherever you are: tie visibility to the task, use free-text fields sparingly, and store sensitive content encrypted instead of spreading it across files and attachments.

Keeping, deleting, giving information

Every review ends with three questions: how long does the data stay, how does it disappear, and what happens when a family asks to see it? Retention is the one point where the GDPR deliberately gives no number – it requires only that data is not kept longer than necessary, and the actual period comes from your education law, differing by category of data as well: attendance in the register, report card data, sick notes and parent communication are kept for very different lengths of time. In Germany those periods are state law and vary between the sixteen federal states; in England they follow the retention schedules that apply to the school's records. A pile of spreadsheets and mailboxes cannot separate any of it, so nothing tends to be deleted there. Articles 15 and 20 add a second duty, mirrored by subject access rights in most other regimes: everything about one person has to be handed over, readable and machine-readable at once. SchuleVernetzt bundles this into a data protection view for the school leadership – a log of access and changes, a configurable period per category of data, and a subject access export per person.