# Education — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/education > Sources are cited per item. Verify against the official texts before relying on them. Processing in educational institutions ## Overview ## Legal Framework Educational institutions process substantial volumes of personal data spanning student records, staff information, and incident documentation. The primary legal basis requirements flow from Article 6 GDPR, with Article 6(1)(f) governing legitimate interests processing — particularly relevant where institutions balance student access rights against staff privacy and safety. Article 5 GDPR imposes the principles of lawfulness, fairness, minimization, and purpose limitation on all such processing. Articles 12 and 15 GDPR establish the data subject's right of access, which creates direct tension when disclosed documents contain third-party personal data. Article 32 GDPR mandates appropriate technical and organizational security measures, while Articles 33 and 34 GDPR require breach notification to supervisory authorities and affected individuals. The EDPB Guidelines 9/2022 clarify breach notification obligations, and EDPB Guidelines 01/2022 address the scope and limitations of access rights. ## Key Developments A 2024 ruling by the Dutch Administrative Jurisdiction Division (Afdeling bestuursrechtspraak) involving Zadkine establishes a practical threshold for redacting staff personal data in educational administrative proceedings. The institution expelled a student whose conduct posed a serious threat to order and safety, then redacted staff names, email addresses, and incident-related observations from documents disclosed to the student. The court upheld restricted access to unredacted versions, weighing staff privacy and safety interests — and the need to preserve confidential incident reporting channels — against the student's access interest. This confirms that where real risks to staff safety exist, Article 15 access rights yield to third-party protection under Article 6(1)(f) balancing. Enforcement actions reinforce two distinct compliance failure points. The Polish DPO (UODO) fined the Minister of Justice €23,540 for insufficient technical and organizational measures, underscoring that educational and public-sector bodies must implement concrete Article 32 safeguards. The Belgian DPA fined Société Wallonne des Eaux €86,000 for lacking a valid legal basis, confirming that Article 6 deficiencies carry significant financial exposure regardless of sector. ## Practical Guidance - **Establish and document a valid Article 6 legal basis for each processing purpose** — educational institutions cannot rely on implicit authority; each category of processing (student administration, incident tracking, staff monitoring) requires an identified and recorded lawful ground. - **Implement a structured redaction protocol for Article 15 access requests** — when disclosing documents to students or parents, assess whether third-party staff data can be disclosed or must be redacted, applying a documented balancing test that weighs safety risks, confidentiality of incident reporting, and the data subject's legitimate access interest. - **Maintain a confidential incident reporting framework** — the Zadkine ruling demonstrates that courts will protect the integrity of staff incident reports where unrestricted disclosure would chill future reporting; document this rationale when redacting. - **Deploy Article 32 technical and organizational measures proportionate to risk** — the UODO enforcement action confirms that generic security policies are insufficient; institutions need access controls, encryption, logging, and staff training specifically calibrated to the sensitivity of educational data. - **Prepare a breach response procedure aligned with EDPB Guidelines 9/2022** — educational institutions handling minors' data face elevated breach notification obligations; establish internal detection, assessment, and notification workflows covering both the 72-hour authority notification and individual notification thresholds. ## Case law ### Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein *Source: CJEU, C-210/16, 2018-06-05 — https://overview.legal/posts/51477 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210&ref=51477* Facebook fan page administrators are joint controllers with Facebook. ## Guidance ### Guidelines 01/2022 on data subject rights - Right of access *Source: EDPB, edpb-guidelines-on-data-subject-rights---right-of-access, 2023-04-17 — https://overview.legal/posts/38055 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en* The right of access of data subjects is enshrined in Art. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR. ### Guidelines 9/2022 on personal data breach notification under GDPR *Source: EDPB, edpb-guidelines-on-personal-data-breach-notification-under-gdpr, 2023-04-04 — https://overview.legal/posts/38058 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en* The EDPB adopted Guidelines 9/2022 (Version 2.0, 28 March 2023) to update and replace the prior WP250 guidance on personal data breach notification under Articles 33 and 34 of the GDPR. The guidelines address the definition and types of personal data breaches, controller and processor notification obligations, the concept of a controller becoming "aware" of a breach, cross-border and non-EU establishment breach scenarios, and the conditions under which notification to supervisory authorities and data subjects is or is not required. ### Guidelines 01/2021 *Source: EDPB, edpb-guidelines-on-examples-regarding-personal-data-breach-notification, 2022-01-03 — https://overview.legal/posts/38047 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en* The European Data Protection Board (EDPB) adopted Guidelines 01/2021 on December 14, 2021, providing practical examples and analysis regarding personal data breach notification obligations under Articles 33 and 34 of the GDPR. The guidelines present hypothetical scenarios covering ransomware attacks and data exfiltration incidents, illustrating how controllers should assess risk to determine whether notification to supervisory authorities and communication to data subjects are required. The document serves as interpretive guidance for controllers evaluating breach severity, appropriate mitigation measures, and notification decisions, and does not impose any fines or sanctions. ### Guidelines 07/2020 on the concepts of controller and processor in the GDPR *Source: EDPB, edpb-guidelines-on-the-concepts-of-controller-and-processor-in-the-gdpr, 2021-07-07 — https://overview.legal/posts/38069 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en* The concepts of controller, joint controller and processor play a crucial role in the application of the General Data Protection Regulation 2016/679 (GDPR), since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The precise meaning of these concepts and the criteria for their correct interpretation must be sufficiently clear and consistent throughout the European Economic Area (EEA). The conc... ### Guidelines 8/2020 on the targeting of social media users *Source: EDPB, edpb-guidelines-on-the-targeting-of-social-media-users, 2021-04-13 — https://overview.legal/posts/38073 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en* The EDPB adopted Guidelines 8/2020 on the targeting of social media users to clarify the roles, responsibilities, and legal obligations of the various actors involved in social media targeting, including social media providers, targeters, and users. The guidelines analyze different targeting mechanisms—based on provided, observed, and inferred data—and address controller determinations, legal bases, transparency requirements, DPIAs, and the processing of special categories of data. No fines are imposed, as this is interpretive guidance intended to assist stakeholders in achieving GDPR compliance. ### Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 *Source: EDPB, edpb-guidelines-on-relevant-and-reasoned-objection-under-regulation-2016679, 2021-03-09 — https://overview.legal/posts/38061 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-092020-on-relevant-and-reasoned-objection-under-regulation-2016679_en* The European Data Protection Board (EDPB) issued these guidelines to clarify the criteria for a "relevant and reasoned objection" by supervisory authorities within the GDPR's cooperation mechanism under Article 65. The guidelines specify that an objection must be both "relevant" (directed at the substance of the draft decision) and "reasoned" (supported by substantive arguments regarding GDPR compliance or risks to fundamental rights and the free flow of personal data within the Union). No fine amounts are involved, as this document provides interpretive guidance rather than an enforcement decision. ### Guidelines 05/2020 on consent under Regulation 2016/679 *Source: EDPB, edpb-guidelines-on-consent, 2020-05-04 — https://overview.legal/posts/38053 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en* The European Data Protection Board (EDPB) adopted Guidelines 05/2020 on consent under Regulation 2016/679 to provide detailed interpretive guidance on the requirements for valid consent under the GDPR, including the elements of freely given, specific, informed, and unambiguous consent, as well as the conditions for explicit consent and the obligation to demonstrate consent. The guidelines address practical issues such as power imbalances, conditionality, granularity, detriment, and the minimum content requirements for informing data subjects. No fines are imposed, as this is a guidance document rather than an enforcement decision. ### Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation *Source: EDPB, edpb-guidelines-on-certification-and-identifying-certification-criteria, 2019-06-04 — https://overview.legal/posts/38048 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-12018-on-certification-and-identifying-certification-criteria-in_en* The EDPB issued Guidelines 1/2018 to clarify the framework for data protection certification and the identification of certification criteria under Articles 42 and 43 of the GDPR. The guidelines address key concepts such as the interpretation of "certification," the roles of supervisory authorities and certification bodies, and the process for approving certification criteria. This document provides practical guidance to stakeholders on how GDPR certification mechanisms, seals, and marks should be established and operated. ## Enforcement decisions ### Het hoger onderwijsinstelling 'Statista Aldo Moro' in Fara Sabina: Onvoldoende wettelijke basis voor de verwerking van gegevens. *Source: Italian Data Protection Authority (Garante), 2025-10-23 — https://overview.legal/posts/52002* De Italiaanse gegevensbeschermingsautoriteit heeft het hoger onderwijsinstelling 'Statista Aldo Moro' in Fara Sabina een boete van 4.000 euro opgelegd. De verantwoordelijke instantie heeft een protocol van tuchtprocedures op haar officiële website gepubliceerd, waarin persoonlijke gegevens van de betrokken persoon waren opgenomen. ### Istituto Comprensivo 2 C.D. “G. Modugno” S.M. “G. Galilei” in Monopoli: Onvoldoende juridische basis voor de verwerking van gegevens. *Source: Italian Data Protection Authority (Garante), 2025-07-10 — https://overview.legal/posts/52216* De Italiaanse gegevensbeschermingsautoriteit heeft een boete van 4.000 euro opgelegd aan de onderwijsinstelling Istituto Comprensivo 2 C.D. “G. Modugno” S.M. “G. Galilei” in Monopoli. De verantwoordelijke instantie heeft een lijst met de namen van leerlingen met een beperking op haar website gepubliceerd zonder voldoende juridische basis. ### Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4) *Source: Datatilsynet (Denmark), 2022-09-28 — https://overview.legal/posts/6313 — original: https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_2020-431-0061_(Helsingor_decision_no._4)* Facts — This is the Danish DPA's fourth decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor municipality, the controller, has been using Google Chromebooks and Workspace for Education in violation of several GDPR requirements, as detailed in the first decision of September 2021, the second decision of 14 July 2022 and the third decision of 18 August 2022. Following the third decision, the municipality submitted more documentation and also requested a consultation with the DPA as per Article 36 GDPR. Holding — The DPA temporarily suspended its processing ban against Helsingor municipality until 5 November 2022, and also ordered the municipality to: Change the data processing agreement with Google so that the DPA's remarks in their 14 July and 18 August decisions, are implemented. This includes, at a minimum, a clarification of where and if Google acts as a sole controller and any uncertainties that may entail that Google acts beyond their role as a processor, see Article 28(3)(a) GDPR. Document that all transfers of personal data to insecure third countries, are in line with the GDPR. Describe all data flows and identify the personal data that are shared with the vendor, and clarify when the vendor acts as a sole or joint controller. This documentation must include the whole technology stack used by the municipality (for this processing activity). Update their data protection impact assessment based on all identified risks. Consult the DPA if the DPIA shows any high risks the municipality is not able to mitigate. If any processing activities are still not in line with the GDPR before the DPA's deadline 3 November 2022, present a final plan for bringing them in line with the GDPR. ### Colegio Arenales Carabanchel (School): Insufficient legal basis for data processing *Source: Spanish Data Protection Authority (aepd), 2020-02-14 — https://overview.legal/posts/46322 — original: https://www.enforcementtracker.com/ETid-207* The decision of the data protection authority states that the school transferred pictures (and therefore personal data) to third parties, who published them without legal basis. ### Ministerie van Binnenlandse Zaken - Dienst Brandweer, Openbare Redding en Civiele Bescherming - Provinciale Commandostructuur van Florence: Niet-naleving van algemene principes voor gegevensverwerking. *Source: Italian Data Protection Authority (Garante), 2025-09-11 — https://overview.legal/posts/52096* De Italiaanse gegevensbeschermingsautoriteit (DPA) heeft het Ministerie van Binnenlandse Zaken een boete van 12.000 euro opgelegd. Tijdens de Covid-19-pandemie publiceerde de verantwoordelijke instantie een lijst met de namen en vaccinatiestatus van werknemers in een interne Telegram-groep met ongeveer 260 leden. ### Primary School: Insufficient legal basis for data processing *Source: Croatian Data Protection Authority (azop), 2025-09-01 — https://overview.legal/posts/53523 — original: https://www.enforcementtracker.com/ETid-3072* Croatian Data Protection Authority (azop) fined Primary School €2,000 on 2025-09-01 for: Insufficient legal basis for data processing. ### Liceo Statale 'Edoardo Amaldi”: Insufficient legal basis for data processing *Source: Italian Data Protection Authority (Garante), 2022-09-01 — https://overview.legal/posts/47550 — original: https://www.enforcementtracker.com/ETid-1435* The Italian DPA has imposed a fine of EUR 4,000 on the school 'Edoardo Amaldi'. The school had published a circular on the school website about the summer vacations which contained the exact vacation dates of the school staff. ### Educationest s.r.l.: Insufficient legal basis for data processing *Source: Italian Data Protection Authority (Garante), 2022-04-28 — https://overview.legal/posts/47308 — original: https://www.enforcementtracker.com/ETid-1193* The Italian DPA has fined Educationest s.r.l. EUR 1,000. The daycare center had sent an email to the families of the children in its care, informing them of the pregnancy and the maternity leave of one of the educators. The daycare center had written the e-mail to prevent rumors about the teacher's absence ( e.g. a covid illness) and to protect her. However, the educator had not consented to the disclosure of her pregnancy status. The DPA therefore found that Educationest had unlawfully processe ## Recent developments ### noyb win: Microsoft 365 Education may not track school children *Source: noyb - European Center for Digital Rights, 2025-10-09 — https://overview.legal/posts/53134 — original: https://noyb.eu/en/noyb-win-microsoft-365-education-tracks-school-children* Data Subject Rights The Austrian Data Protection Authority ("DSB") issued a decision finding that Microsoft 365 Education illegally tracks students and uses student data for Microsoft's own purposes. The software giant also did not answer an access request related to Microsoft 365 Education, which is widely used in European schools. Instead, Microsoft tried to shift all responsibility to local schools. While the relevant schools also have to provide more detailed access data and additional priva ### Wat is er gebeurd met de risicogebaseerde aanpak voor de overdracht van gegevens? *Source: Future of Privacy Forum, 2022-09-27 — https://overview.legal/posts/51813* De AVG (Algemene Verordening Gegevensbescherming) omvat de verantwoordingsplicht (RBA) voor alle verplichtingen van de verantwoordelijke partij zoals die in de AVG zijn vastgelegd. Waar de overdrachtsregels worden beschreven als verplichtingen van de verantwoordelijke partij (in plaats van als absolute principes), is de verantwoordingsplicht van artikel 24 dus van toepassing. Volgens Lokke Moerel, professor in het internationaal ICT-recht aan de Universiteit van Tilburg en expert op het gebied van cyberbeveiliging, wordt dit niet tegengesproken door het vonnis van het Europees Hof van Justitie in de zaak Schrems II, noch door de aanbevelingen van het EDPB (European Data Protection Board) over aanvullende maatregelen na het vonnis Schrems II. ### Hervorming van de privacywetgeving in het Verenigd Koninkrijk: Hoe de GDPR van het VK mogelijk zal veranderen. *Source: Hogan Lovells, 2022-09-06 — https://overview.legal/posts/51835* De huidige versie van het wetsvoorstel streeft ernaar om de meeste belangrijke principes te behouden die ten grondslag liggen aan het Britse kader voor gegevensbescherming, terwijl tegelijkertijd bepaalde belangrijke bepalingen worden aangepast met betrekking tot onder meer verantwoordelijkheid, de wettelijke gronden voor gegevensverwerking, verzoeken van betrokkenen en cookies. Een [geconsolideerde versie met wijzigingen van de Britse GDPR, opgesteld door Hogan Lovells](https://www.engage.hoganlovells.com/knowledgeservices/attachment_dw.action?attkey=FRbANEucS95NMLRN47z%2BeeOgEFCt8EGQJsWJiCH) ### HvJ: De PNR-richtlijn is geldig, mits deze beperkt blijft tot wat "strikt noodzakelijk" is. *Source: eucrim, 2022-08-04 — https://overview.legal/posts/51841* Op 21 juni 2022 heeft het Gerechtshof van de Europese Unie (Groot Beschouwingscollege) een baanbrekende uitspraak gedaan waarin het het EU-regime voor het verzamelen en gebruiken van gegevens van reizigers bevestigde, mits dit strikt wordt geïnterpreteerd in overeenstemming met de fundamentele rechten van de EU. Bovendien is het zonder onderscheid verwerken van deze gegevens bij vluchten die uitsluitend binnen de EU plaatsvinden verboden, tenzij er een dreiging van terrorisme bestaat. Over het algemeen moeten de gegevens van de passagiers ook binnen zes maanden worden verwijderd. ### WODC: Rapport Bescherming gegeven Evaluatie UAVG meldplicht datalekken en de boetebevoegdheid *Source: News, 2022-06-30 — https://overview.legal/posts/6300 — original: https://www.rijksoverheids.nl/documenten/kamerstukken/2022/09/06/tk-aanbiedingsbrief-rapport-bescherming-gegeven-evaluatie-uavg-meldplicht-datalekken-en-de-boetebevoegdheid#entry-207* > Het onderzoek laat zien dat de duidelijkheid en toegankelijkheid van de UAVG kritisch wordt beoordeeld. Mede de ‘beleidsneutrale’ invulling van de wet en de korte tijd waarin deze tot stand moest komen hebben daartoe geleid. Wanneer wordt bezien hoe AP en de jurisprudentie nader invulling hebben gegeven aan de normen in de wet is de conclusie dat dit deels is gebeurd, maar voor een ander deel ook nog verder dient te worden uitgewerkt. In het onderzoeksrapport worden daarvan op verschillende pl ## Literature ### GDPR Implementation Series ∙ Netherlands: The GDPR Implementation Act *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132478 — original: https://doi.org/10.21552/edpl/2018/3/15* ### GDPR Implementation Series ∙ Austria: A Brief Overview Concerning the Implementation of the GDPR *Source: European Data Protection Law Review, 2017-01-01 — https://overview.legal/posts/132489 — original: https://doi.org/10.21552/edpl/2017/2/12* ### Collective Damages for GDPR Breaches: A Feasible solution for the GDPR Enforcement Deficit? *Source: European Data Protection Law Review, 2022-01-01 — https://overview.legal/posts/132504 — original: https://doi.org/10.21552/edpl/2022/4/8* ### GDPR Implementation Series ∙ Malta: An Overview of the GDPR Implementation *Source: European Data Protection Law Review, 2020-01-01 — https://overview.legal/posts/132480 — original: https://doi.org/10.21552/edpl/2020/4/15* ### GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection *Source: European Data Protection Law Review, 2019-01-01 — https://overview.legal/posts/132426 — original: https://doi.org/10.21552/edpl/2019/4/11* ## Related topics - **Public Authority** — https://overview.legal/topics/overheid Government bodies and their data processing activities - **Public Sector** — https://overview.legal/topics/public-sector Processing by public authorities - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Personal Data** — https://overview.legal/topics/persoonsgegevens Information relating to identified or identifiable natural persons - **Processing Agreement** — https://overview.legal/topics/verwerkersovereenkomst Contract between controller and processor defining processing terms - **Processing** — https://overview.legal/topics/verwerking Any operation performed on personal data --- Generated by overview.legal · https://overview.legal/topics/education · 2026-08-22