Definition of data protection in schools
A school's personal data includes names and addresses, grades and report cards, absences, photos, and messages to parents. Health information, for example from doctor's notes, is subject to special protection.
In the narrower sense, data protection determines whether and for what purpose a school may process such data. Data security covers the technical and organizational measures that protect it, such as encryption and access rights.
Legal basis and principles
The key rules are the General Data Protection Regulation (GDPR), the data protection acts of the German states, and their school laws. Together they determine which data a school may process for its educational mandate.
For anything beyond this mandate, the school usually needs consent. Consent is voluntary, and withdrawing it must be as easy as giving it.
GDPR principles
Every processing operation must follow these principles:
- Lawfulness and transparency: the school only processes data with a legal basis and informs the people concerned in clear language.
- Purpose limitation: data collected for one purpose may not simply be reused for another.
- Data minimization: the school only collects what the task requires.
- Accuracy: data must be correct, and incorrect information is rectified.
- Storage limitation: data is deleted once the school no longer needs it for its purpose.
- Integrity and confidentiality: the school protects data against unauthorized access, alteration, and loss.
- Accountability: the school must be able to demonstrate that it complies with these principles.
Roles and responsibilities
The controller under the GDPR is usually the school, represented by the head of school. Teachers and administrative staff process data on behalf of the school and are bound by confidentiality.
Public schools need data protection officers who advise them and check that the rules are followed. One person can be responsible for several schools.
If a service provider processes data on the school's behalf, for example as the provider of school software, the two parties sign a data processing agreement. The school remains responsible.
Rights of data subjects and data breaches
Students, parents, and staff have rights including access to their data, rectification, and erasure. The school must respond within one month; for complex requests, this period can be extended.
The school can only erase data that is no longer subject to a retention obligation. The German states set how long schools keep documents such as report cards or student files.
If data is lost or reaches unauthorized persons, the school reports the breach to the supervisory authority without undue delay, unless it is unlikely to result in a risk to the people concerned. If the risk is high, the school also informs those affected directly. Every breach must be documented, even when no report is required. This overview does not replace legal advice.
Data protection in everyday school life
Keep a record of which data your school processes, for what purpose, and with which programs.
Give each role access only to the data it needs for its tasks.
Decide how long you keep which data, and delete it afterwards.
Before introducing it, clarify with your data protection officer where the data is stored and whether a data protection impact assessment is required.
Data protection at OhayoSchool
OhayoSchool processes your school's data as a processor, and the data processing agreement is part of every user agreement. All data is kept on dedicated servers in Germany and encrypted both at rest and in transit.
The OhayoSchool team only accesses your school's account when you approve it for a specific request. Access is time-limited and read-only at first, and every session appears in a log your school can view. Without approval, OhayoSchool only accesses the account in a security incident and notifies your school immediately.
A learning profile is only created once parents or guardians have given their consent. OhayoSchool pseudonymizes learning profiles and practice data. The language models run on OhayoSchool's own servers, and no request goes to external AI providers.
OhayoSchool includes these tools to help your school meet its obligations:
- Decide for yourself which role sees and changes which data, and see every change to school data in the log.
- Respond to requests for access and erasure in OhayoSchool. OhayoSchool carries out erasure by anonymizing the person's records.
- Keep track of consent for each type of processing, including every withdrawal.
- Adjust the retention periods in OhayoSchool to the rules of your state.
- Record every data breach and see in one overview how far each case has progressed.
- Link parents to their child with a personal code that you send by letter or email. Your school office approves requests without a code, and you can revoke any link.
- Every user can download their own account data.
Frequently asked questions
May a school publish photos of students on its website?
Usually only with consent. For minors, who gives consent depends on their age and the rules of the state.
When does a school need a data protection impact assessment?
When processing is likely to result in a high risk to the people concerned, for example when new technologies are used. The assessment describes the processing and its risks and sets out how the school will limit them.
What do OhayoSchool's data protection tools cost?
The data protection tools are part of the Administration package and included in the price per student per month. Accounts for teachers, office staff, and school leaders cost nothing extra. See pricing