Adopting a new EdTech platform means entrusting pupils’ personal data to a third party — and because the school remains accountable for that data, the choice carries real weight. Choosing a GDPR-compliant platform is not about paperwork; it is about protecting children’s information. This article sets out how schools can assess EdTech platforms for GDPR compliance before they adopt them.
Quick summary
- The school remains accountable for pupil data even when a provider processes it.
- Assess platforms on data processing, security, storage location, retention, data subject rights and DPIAs.
- A data processing agreement should be in place before sharing pupil data.
- Adopting a new platform is usually a DPIA trigger — assess before you commit.
Why the choice matters
When a school adopts an EdTech platform, the provider typically acts as a data processor while the school remains the data controller — and therefore accountable for the data. If a provider mishandles pupil data, the consequences reach the school. Choosing carefully is a core part of protecting pupils, not a procurement formality — see What UK Schools Need to Know About Student Data Protection.
What to check before adopting a platform
1. Data processing and purpose
- What personal data does the platform collect, and is it minimised?
- For what purposes is it used — and is it ever used for anything beyond serving the school (e.g. marketing)?
- Is data ever sold or shared with third parties?
2. Security
- Is data encrypted at rest and in transit?
- What security measures and certifications does the provider hold?
- How is access controlled within the provider?
3. Storage location
- Where is data stored, and if outside the UK, what safeguards apply to international transfers?
- Is the hosting reputable and secure?
4. Retention and deletion
- How long is data retained, and can it be deleted or anonymised on request?
- What happens to data when the contract ends?
5. Data subject rights
- Can the provider support the school in honouring access, rectification, erasure, restriction and objection?
6. Documentation and accountability
- Does the provider have a privacy policy, a DPIA, and a data processing agreement ready?
- Can it evidence its compliance rather than just assert it?
The importance of a data processing agreement
Before sharing pupil data, a data processing agreement (DPA) should be in place, setting out the provider’s obligations as a processor — what they can do with the data, their security obligations, and their duties around breaches, sub-processors and deletion. A provider unwilling or unable to sign an appropriate DPA is a warning sign.
Do a DPIA before you commit
Adopting a new platform that processes pupil data is a common DPIA trigger. Complete a DPIA that assesses the platform’s data handling and risks before committing — a provider that shares its own DPIA makes this far easier.
Warning signs
- Vague answers about where data is stored or who can access it.
- Reluctance to sign a data processing agreement.
- Data used for purposes beyond serving the school.
- No privacy policy or DPIA available.
- Inability to support data subject rights or deletion.
For a ready-made set of questions, see Questions Schools Should Ask Every EdTech Provider.
Frequently asked questions
Who is responsible for pupil data on an EdTech platform?
The school remains the accountable data controller; the provider is usually a data processor acting on the school’s behalf.
What should schools check before adopting EdTech?
Data processing and minimisation, security, storage location, retention and deletion, data subject rights, and documentation such as a DPIA and data processing agreement.
What is a data processing agreement?
A contract setting out the provider’s obligations as a data processor, including security, breach handling, sub-processors and deletion.
Do we need a DPIA before adopting a platform?
Usually yes. Adopting a platform that processes pupil data is a common DPIA trigger; assess before committing.
What are warning signs of a non-compliant provider?
Vagueness about data storage or access, reluctance to sign a DPA, using data beyond serving the school, and no privacy policy or DPIA.
Does where data is stored matter?
Yes. Storage location affects security and international transfer safeguards, which schools should confirm.
Conclusion
Choosing a GDPR-compliant EdTech platform is an act of protecting pupils’ data. Assess each platform on how it processes, secures, stores, retains and deletes data, and whether it supports data subject rights — backed by a DPIA and a data processing agreement. Do this before you commit, and new technology strengthens learning without compromising privacy.
How AI Buddy supports schools
AI Buddy is designed to meet exactly the criteria schools should demand of any EdTech platform. Built by Tutopiya to support schools in strengthening areas evaluated during Ofsted inspections, it minimises and pseudonymises pupil data, encrypts and hosts data on AWS, retains data only as needed (anonymising on account closure), supports defined data-subject rights, and operates under a documented data protection policy and DPIA — the evidence a school needs for its own vetting and DPIA. AI Buddy is not endorsed or certified by Ofsted; it is built to be the kind of compliant platform this article describes.
Discover how AI Buddy helps schools strengthen teaching, learning and evidence-informed school improvement. Or start a short consultation with our schools team using the form below.
Sources
- Information Commissioner’s Office, Contracts and data processing agreements (ICO)
- Information Commissioner’s Office, UK GDPR guidance and resources (ICO)
- Department for Education, Data protection in schools (GOV.UK)
- Data Protection Act 2018 (legislation.gov.uk)