Education & training · GDPR

Education & training — GDPR: protecting learner data

The educational audience is predominantly made up of minors, which raises the GDPR standard: parental consent based on age, the best interests of the child, data minimisation, caution around profiling, and oversight of proctoring. This guide details these obligations and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Institutions, schools, training organizations, and EdTech companies are concerned.
  • Ground the processing.
  • Putting the child's best interest first.
  • Minimise and regulate profiling.
  • Fines of up to €20M or 4% of global turnover, with heightened scrutiny on minors.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

The GDPR grants enhanced protection to children's data. Depending on age and legal basis, parental consent may be required, and the best interests of the child must take precedence. Intrusive processing activities (proctoring, profiling) require a DPIA.

Institutions frequently act on the basis of a public-interest mission or a legal obligation.

Is the 'Education & training' sector concerned?

Schools, educational institutions, training organisations and EdTechs are all in scope. EdTechs act as processors or controllers depending on the context and must be governed accordingly.

Families are stakeholders in the information and, depending on age, in consent.

Detailed obligations

Ground the processing

Identify the legal basis and, for minors, manage parental consent according to age.

Prioritise the best interests of the child.

Integrate the best interests of the child into processing decisions.

Minimise and regulate profiling.

Minimise data and strictly govern the profiling of learners.

Frame proctoring

Carry out a DPIA and proportion the monitoring of examinations.

Secure

Security and retention periods adapted to learner data.

Sanctions & risks

Fines of up to €20M or 4% of global turnover, with heightened scrutiny regarding minors. Intrusive, unregulated processing (e.g. proctoring) is particularly exposed.

Common mistakes in the sector

  • 1Parental consent omitted. Processing minors' data without managing the required consent.
  • 2Unevaluated proctoring. Monitoring assessments without a DPIA.
  • 3Excessive profiling. Profile learners without a framework.
  • 4Excessive retention. Retain data beyond what is necessary.

Practical case

An online training provider was collecting detailed behavioural data on minor learners. Following analysis, it limits data collection, manages parental consent, conducts a DPIA for proctoring, and informs families.

Compliance roadmap

  1. 1

    Map. Inventory learner data processing.

  2. 2

    Manage consent. Organise parental consent according to age.

  3. 3

    Minimise. Limit data and profiling.

  4. 4

    Frame proctoring. Conduct the DPIA.

  5. 5

    Secure. Appropriate retention periods and security.

Frequently asked questions

For minors, depending on age and the legal basis, parental consent may be required.

Back to the Education & training guideEducation & training & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to education & training.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the education & training sector secured their compliance with DCO.

See testimonials