GDPR: which student data can a teacher collect?

Who is responsible for what

This is the least understood point, and everything else follows from it.

• The institution is the data controller. It decides why and how data is used. A teacher acts within that framework, not in a personal capacity.
• The tool vendor is a processor. It handles data on the institution's behalf, following its instructions, and may not use it for other purposes.
• A data protection officer exists in most organisations. That is your contact before adopting a tool, not after an incident.

The practical consequence: a teacher adopting a tool alone commits their institution without its knowledge. It is not a moral failing, it is a common blind spot — and exactly what the approach below prevents.

On what basis can this data be processed?

Every processing operation needs a legal basis. In education, the most common one is not the one people assume.

• Public interest task — the usual basis in state education. Teaching, assessing and tracking progress fall within the institution's mission.
• Performance of a contract — common in private education and professional training: the learner signed up to receive it.
• Consent is rarely the right basis. It assumes a free choice, which is doubtful between a student and their teacher. Consent that cannot be refused without consequence is not valid consent.

Consent remains relevant for anything outside the teaching frame: publishing a photograph, sharing work beyond the class, using an optional service.

What is defensible, and what is not

The minimisation principle is tested by one simple question: would the activity work without this data? If yes, do not collect it.

• A first name, for the duration of an activity — defensible in almost every case. It attributes an answer during the session, and nothing more.
• Full name — defensible if you need to track an identified learner over time, or issue a certificate.
• Personal email address — rarely necessary for a classroom activity. A link on the board avoids that collection entirely.
• Date of birth, address, phone number — unrelated to a teaching activity. That data belongs in the institution's administrative records.
• Photographs and recordings — a separate regime requiring specific information and, outside a strictly pedagogical frame, agreement.

The useful reflex is the opposite of habit: do not ask "am I allowed to collect this?", ask "what can I avoid collecting?". An activity that works with a first name typed on the spot is far easier to justify than a filled-in student account.

How long to keep it, and how to delete it

Retention is the most frequently forgotten obligation. Data is not meant to stay indefinitely because it might be useful one day.

• Session activity records (participation, answers) serve no purpose beyond the school year. Purge them at the end.
• Assessment results are kept for the duration of the course, then fall under the institution's archiving rules.
• Accounts of learners who have left must be deleted. It is the most commonly forgotten stock, and the most exposed in an incident.

Check that the tool genuinely deletes rather than merely hides. An "archive" that keeps everything forever does not meet the obligation.

Data subjects have rights you must be able to honour: access their data, correct it, request erasure. A family that writes in should get an answer within one month.

Seven questions to ask before adopting a tool

This list fits on one page and can be put to any vendor. An evasive answer is itself an answer.

• Exactly what data is collected, and which fields are optional?
• Where is it hosted? Hosting within the European Union simplifies the file considerably.
• Are there transfers outside the EU? If so, on what legal safeguard?
• Is there a processing agreement? It is mandatory and the vendor should provide it without negotiation.
• What retention periods apply, and is deletion effective?
• Are there advertising trackers or any resale of data? In an educational setting the answer must be no.
• Can learners take part without creating an account? That is often the simplest way to reduce the whole question to almost nothing.

Keep the answers in writing: they form most of the file your data protection officer will ask for.

This article describes general principles and does not constitute legal advice. For a specific case, consult your organisation's data protection officer.