School software and the GDPR

School software and the GDPR: what actually matters

School software and the GDPR – the question behind it is nearly always the same: who may see which data, where is it held, and who carries the responsibility? The short answer: the controller under the GDPR is the school as an institution, not the individual teacher and not the provider. The provider processes the data on the school's behalf and is bound by its instructions. Everything else – contract, roles, retention periods, records – follows from that division of roles. This page sorts out the terms and shows which points should be settled before a rollout. It is not legal advice: school law is set by each federal state, and binding answers come from the school's data protection officer and the state supervisory authority.

Notify me See all modules

Coming soon

  • GDPR-compliant
  • Hosted in Germany
  • Free for teachers

A product of SavePaper.work

Benefits

Four points that should be settled before a rollout

The school is the controller

The GDPR names one controller, and that is the school as an institution. It determines the purposes and means of processing – even when the data actually sits on a teacher's own device.

A contract under Article 28

Anyone processing data on the school's behalf needs a contract for it. It sets out which data is processed for what purpose, which sub-processors are involved and what happens to the data when the contract ends.

Access by role

Not everyone on the staff needs every detail. A role model limits the view to what the task requires – and afterwards makes it verifiable who accessed what, and when.

The state sets the periods

How long school records are kept is regulated differently by each federal state, and the periods also differ by category of data. Software should be able to reflect that instead of treating everything alike.

How it works

How a data protection review at school works

The review nearly always follows the same order: first clarify who is responsible, then describe what is processed, then read the contract, and finally set roles and retention periods.

1 2 3 4
  1. 1

    Clarify responsibility

    Who decides on purposes and means – the school, the school authority, or both together? This question comes first, because it determines who signs the contract and who answers to parents.

  2. 2

    Describe the processing

    Which data, for what purpose, visible to whom, for how long? These entries belong in the record of processing activities, which the school keeps itself. A provider can supply the building blocks for it.

  3. 3

    Review contract and measures

    The data processing agreement and the description of technical and organisational measures are read together: server location, sub-processors involved, encryption, deletion at the end of the contract, and how the school issues instructions.

  4. 4

    Set roles and periods

    Configuration comes last: which role sees which detail, which retention period applies to which category of data? Both depend on state law and are set once for the whole school, not per teacher.

In comparison

The same data, two ways of keeping it

Processing in a school system
Who sees the dataThe role decides the view, separated by task
Where the data is heldA named server location, fixed in the contract
What stays traceableAccess and changes are written to a log
When data is deletedOne period per category, set by the school
Scattered files and private channels
Who sees the dataWhoever holds the file or the chat sees everything in it
Where the data is heldPrivate device, mailbox, changing cloud folders
What stays traceableHard to reconstruct after the fact
When data is deletedUsually never – copies simply stay behind
In detail

The terms that come up in every review

Processing on behalf, responsibility and instructions

The data processing agreement under Article 28 GDPR is not a form to fill in but the description of a relationship. The school remains the controller and determines which data is processed for what purpose; the provider processes it solely on instructions and never for its own purposes. The agreement also covers duration and subject matter, the categories of people affected, the protective measures, support with access requests, the reporting of incidents, the handling of sub-processors, and what becomes of the data once the contract ends. That same division of roles explains why a grade list on a private laptop is the school's problem: the school stays responsible, yet on someone else's device it can neither limit access nor prove what happened to the file.

Grades, sick notes and Article 9

Not all school data is equally sensitive. The reason given for a sick note is health data and therefore one of the special categories under Article 9 GDPR, for which stricter requirements apply. In practice this can be defused: for an absence note it is usually enough to know that the absence was due to illness – a reason stays voluntary. Grades and assessments, by contrast, do not fall under Article 9, which does not make them harmless: they describe performance over years and shape transitions and qualifications. Both point to the same conclusion – tie visibility to the task, use free-text fields sparingly, and store sensitive content encrypted instead of spreading it across files and attachments.

Keeping, deleting, giving information

Every review ends with three questions: how long does the data stay, how does it disappear, and what happens when a family asks for information? Retention periods for school records are state law and differ by category of data as well: attendance in the class register, report card data, sick notes and parent communication are kept for very different periods. A pile of spreadsheets and mailboxes cannot separate them, so nothing tends to be deleted there. Articles 15 and 20 also require everything about one person to be handed over – readable and machine-readable at once. SchuleVernetzt bundles this into a data protection view for the head teacher: a log of access and changes, a period per category based on the federal state, and a subject access export per person.

What a school can ask the provider for

Four documents can be requested before deciding: the data processing agreement, the description of the technical and organisational measures, a list of the sub-processors involved together with their location, and a processing description the school can feed into its own record of processing activities. A provider who only assembles these papers on request delays the review by weeks. SchuleVernetzt keeps them ready, so that school authorities and data protection officers do not have to build anything themselves. The application and the school data are hosted in Germany.

See all modules
FAQ

Frequently asked questions about school software and data protection

The school as an institution, represented by its head – depending on the federal state, together with the school authority. It decides on the purposes and means of processing. The provider is a processor and acts on instructions. The individual teacher is neither one nor the other, but works within the school's public task.

As soon as a service provider processes personal data on the school's behalf, the GDPR provides for a contract – regardless of how large or small the tool is. Whether a particular application falls under it is clarified by the school's data protection officer; the state authorities publish guidance on this.

For the mandatory part of school work, usually not: this processing is normally based on the school's statutory task under state law, not on consent. Consent is the route for anything voluntary, such as photographs or additional contact channels. A public body cannot rely on legitimate interests when carrying out its tasks.

No. Grades are not among the special categories under Article 9 GDPR, which covers health, origin and religious belief among other things. They are nonetheless highly worthy of protection, because they shape educational paths. A sick note, on the other hand, does produce genuine health data as soon as a reason is recorded.

That depends on the federal state and on the category of data; there is no single figure valid nationwide. Report card data is kept considerably longer than attendance or sick notes. What is binding are the rules of the respective state school law – the school's data protection officer and the state authority will name the periods that apply.

The school owes the information as controller; the provider supports it in doing so. What can be requested is a copy of the stored data and, in certain cases, its release in a common machine-readable format. In SchuleVernetzt both can be produced together for one person, and the act itself is written to the log.
Discover more

More modules in this category

View all modules
School Management Software
Digital Notice Board for Schools
School Management Software
Grade Management App Teachers
Grade Management Excel Alternative
Introducing school software
IServ alternative
Schulmanager Online alternative
Grade Calculator Tool
Coming soon

Be there when SchuleVernetzt launches

We're building SchuleVernetzt at full speed. Leave your email and we'll notify you the moment your school can get started – free and with no obligation.

We use your address only to notify you at launch, and you can unsubscribe at any time.