Contents
- The school as a controller of personal data
- What types of personal data schools process
- Legal bases for processing in education
- When parental consent is required
- Electronic class registers and educational platforms
- Video surveillance in schools
- Photos and video recordings of school events
- Retention periods for pupil data
- DPIA when introducing a new platform
- Personal data breach (leak) – what the school should do
- Practical checklist for schools
- Frequently asked questions
Short answer: Schools are controllers of personal data within the meaning of the GDPR and bear full responsibility for protecting the data of pupils, parents and staff. They process data mainly on the basis of a legal obligation (the Pre-school and School Education Act, ZPUO) and the public interest, not on the basis of consent. For photos, marketing and activities not required by law, however, parental consent is needed. Video surveillance in classrooms is prohibited by the CPDP.
Schools process an enormous amount of personal data – and that of the most vulnerable data subjects: children. Nevertheless, many educational institutions in Bulgaria are not aware of their obligations under the GDPR. This article is a practical guide for head teachers, teachers, DPOs and the administrations of schools and kindergartens, with concrete examples and solutions from Bulgarian practice.
The school as a controller of personal data
Within the meaning of the GDPR, the school (the legal entity) is the controller of personal data. This means that it is the school – not the Ministry of Education and not the provider of the electronic class register – that determines the purposes and means of processing and bears primary responsibility.
As a controller, the school is obliged to:
- Maintain a ROPA (record of processing activities)
- Provide information under Art. 13 GDPR to pupils, parents and staff
- Conclude contracts with processors (Art. 28 GDPR) – electronic class register, hosting, cloud platforms
- Appoint a DPO (data protection officer) if it processes data on a large scale or processes sensitive data
- Apply appropriate technical and organisational protection measures
Important: Many schools in Bulgaria use Shkolo.bg, Google Classroom or Microsoft Teams without having concluded a data processing agreement (DPA) with the provider. This is an infringement of Art. 28 GDPR, which on its own can lead to a fine of up to EUR 10 million (approximately BGN 19.5 million) for private schools; for state and municipal schools, as public bodies – fines under Art. 17 PDPA (up to BGN 5,000 / 20,000).
What types of personal data schools process
Schools collect far more than names and grades:
| Category | Example data | Are they sensitive |
|---|---|---|
| Identification | Full name, personal identification number (EGN), date of birth, address, parent’s telephone number | No (ordinary) |
| Educational records | Grades, attendance, disciplinary offences, minutes of the teachers’ council | No (ordinary) |
| Health data | Allergies, chronic illnesses, disabilities, medical certificates, vaccination status | Yes (Art. 9) |
| Family data | Divorce and custody, social status, income (for social assistance) | Partially |
| Ethnic/religious | Ethnic origin (in integration programmes), religious education | Yes (Art. 9) |
| Visual data | Photos and video recordings of events, CCTV, photos in the pupil’s record book | No (usually) |
| Digital data | School e-mail, logs from e-platforms, IP addresses on access | No (ordinary) |
| SEN data | Special educational needs, psychological assessments, resource support | Yes (Art. 9) |
Recital 38 GDPR: “Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights.” This means that schools must apply higher standards of protection.
Legal bases for processing in education
Contrary to a widespread belief, consent is not the main legal basis for processing data in schools. For most activities, other bases apply:
| Activity | Legal basis | Legal provision |
|---|---|---|
| Enrolment of pupils, keeping class registers, minutes | Legal obligation – Art. 6(1)(c) | ZPUO, Ordinance No. 10 of 01.09.2016 on the organisation of activities in school education |
| Conducting examinations and assessment | Public interest – Art. 6(1)(e) | ZPUO, Ordinance No. 11 of 01.09.2016 on the assessment of pupils’ learning outcomes |
| Issuing diplomas and certificates | Legal obligation – Art. 6(1)(c) | ZPUO |
| School health office, processing of health data | Legal obligation – Art. 6(1)(c) + Art. 9(2)(h) | Health Act, Ordinance on health offices |
| Special educational needs (SEN) | Legal obligation – Art. 6(1)(c) + Art. 9(2)(g) | Ordinance on inclusive education |
| Video surveillance of entrances and schoolyard | Legitimate interest – Art. 6(1)(f) | Protection of safety, documented through an LIA |
| Photos for the school website | Consent – Art. 6(1)(a) | Not required by law; a genuine choice is possible |
| Participation in competitions and olympiads | Consent – Art. 6(1)(a) or public interest – Art. 6(1)(e) | Depends on the organiser and the nature of the activity |
Common mistake: Many schools ask parents for consent for every processing operation, including enrolling the pupil and keeping the class register. This is incorrect: these activities are a legal obligation under the ZPUO. Asking for consent for them creates the false impression that the parent can refuse, which is not the case with compulsory education.
When parental consent is required
Consent is required only for activities that are not provided for by law and in which the parent (or the pupil, if aged 14 or over) has a genuine choice:
- ✓ Publishing photos and video recordings of events on the school’s website or social media
- ✓ Participation in extracurricular activities that require additional data
- ✓ Sending marketing messages on behalf of the school
- ✓ Transferring data to sponsors or partner organisations
- ✓ Registering the pupil on a non-mandatory online platform
- ✗ Consent for enrolling the pupil and keeping the class register (legal obligation)
- ✗ Consent for submitting data to MON/RUO (legal obligation)
- ✗ Consent for processing data for the school health office (legal obligation)
- ✗ Consent for conducting examinations (public interest)
Form of parental consent
Where consent is required, it must meet all the requirements of Art. 7 GDPR:
- Specific and understandable wording
- Indication of the purpose, the data and the recipients
- Information about the right to withdraw
- A separate declaration for each separate purpose (not a general one “for everything”)
- Signature of the parent/guardian (for children under 14)
Do you need template consent declarations for your school?
- Declaration of consent for photos and video
- Information under Art. 13 GDPR for parents and pupils
- Internal rules on personal data protection
Electronic class registers and educational platforms
The Pre-school and School Education Act (ZPUO) requires electronic class registers to be kept. In practice, most Bulgarian schools use Shkolo.bg for the register, and Google Classroom or Microsoft Teams for classroom teaching.
Legal obligations of the school
| Obligation | What it means | Legal basis |
|---|---|---|
| Concluding a DPA | A written data processing agreement with the platform provider | Art. 28 GDPR |
| Checking sub-processors | Which sub-processors the platform uses (hosting, cloud services, analytics) | Art. 28(2) GDPR |
| Transfers outside the EEA | Whether the data is stored or processed in the USA or another third country | Art. 44-49 GDPR |
| Security measures | Encryption, access control, logs | Art. 32 GDPR |
| DPIA | Impact assessment when introducing a new platform with children’s data | Art. 35 GDPR |
Google Classroom and Microsoft Teams
When the school uses Google or Microsoft for teaching:
- The school is the controller, and Google/Microsoft is the processor
- Both companies provide a DPA (Google Workspace for Education Data Processing Amendment; Microsoft DPA)
- The school must check whether the DPA has been signed and whether the administrator account is correctly configured
- Pupils’ data is stored in EU data centres (if selected correctly)
- Transfers to the USA are covered by the EU-US DPF (Data Privacy Framework), but SCCs are recommended as an alternative for recipients not on the DPF list
Practical tip: Require confirmation from Google/Microsoft that the data is stored in the EU. Enable the Data region setting in Google Workspace for Education. Disable Google’s additional services (Additional services) that have no educational purpose.
Shkolo.bg
Shkolo is the most widely used electronic class register platform in Bulgaria. As a Bulgarian provider, its data is usually stored within the EU. Nevertheless:
- The school must have a signed DPA with Shkolo
- Check which sub-processors Shkolo uses (hosting, analytics)
- Make sure that access to the system uses two-factor authentication
- Restrict teachers’ access to their own classes only
Video surveillance in schools
Video surveillance in schools concerns children, which is why the CPDP treats it strictly:
- ✓ Permitted: building entrances, schoolyard, car park
- ✓ Permitted: corridors (with restrictions)
- ✓ Permitted: canteen (entrance area only)
- ✗ Prohibited: classrooms (CPDP position – disproportionate)
- ✗ Prohibited: toilets and changing rooms
- ✗ Prohibited: staff room (without the teachers’ consent)
- ✗ Prohibited: audio recording (eavesdropping)
Requirements for lawful video surveillance
- Legal basis: Legitimate interest (Art. 6(1)(f)), documented through an LIA
- Information signs in visible places before the monitored areas
- Retention period: no more than 30 days (except for a specific incident for which the recording is needed)
- Restricted access: only the head teacher and designated persons have access to the recordings
- Information under Art. 13: a privacy notice on video surveillance, available to parents and staff
- Physical protection: the recording device is kept in a locked room
CPDP position: Cameras in classrooms are disproportionate to the security purpose. The presence of a teacher is a sufficient safety measure in the classroom. Video surveillance in teaching rooms infringes the right to privacy of pupils and teachers and creates pressure that is incompatible with the educational process.
Photos and video recordings of school events
Celebrations, excursions and sports days are almost always photographed. The rules:
For publication on the school’s website/social media
- Legal basis: Consent (Art. 6(1)(a))
- Prior declaration from the parent/guardian (for children under 14)
- For online services offered directly to the child, a pupil over 14 may give consent on their own (Art. 25e PDPA, Art. 8 GDPR). For photos on the website and printed declarations, however, parental consent is required until the age of majority.
- It must be possible to withdraw consent at any time, with subsequent removal of the photos
For internal purposes (album, school chronicle)
- Can be justified by legitimate interest (documenting the educational process)
- Information for parents is required
- The parent may object under Art. 21
Photos taken by other parents
When a parent photographs a celebration and publishes photos showing other people’s children, the GDPR does not apply directly – this is a personal/household activity (Art. 2(2)(c)). The school may nevertheless ask parents to photograph only their own children.
Retention periods for pupil data
| Type of data | Retention period | Legal basis for the period |
|---|---|---|
| Main books (class registers) | Permanently (archival storage) | ZPUO, Ordinance No. 8 of 11.08.2016 on information and documents for the pre-school and school education system |
| Examination minutes | 5 years | Ordinance No. 11 of 01.09.2016 on the assessment of pupils’ learning outcomes |
| Pupils’ personal record cards | 5 years after graduation/leaving | Ordinance No. 8 of 11.08.2016 on information and documents for the pre-school and school education system |
| Health data | Until graduation + 3 years | Health Act |
| CCTV recordings | 30 days | CPDP practice |
| Data from e-platforms | Until graduation (then deletion) | GDPR data minimisation principle |
| Photos (consent) | Until consent is withdrawn | Art. 7(3) GDPR |
| SEN data | 5 years after the support ends | Ordinance on inclusive education |
DPIA when introducing a new platform
Art. 35 GDPR requires a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to the rights of data subjects. For schools, a DPIA is mandatory when:
- A new online platform for processing children’s data is introduced
- Video surveillance is introduced
- Health data or SEN data is processed in digital form
- A new technology is used (biometric access systems, AI tools)
Two criteria from the CPDP list are sufficient for a mandatory DPIA: processing of children’s data + new technologies, processing of children’s data + systematic monitoring, processing of sensitive data + large scale. Schools meet these criteria far more often than they realise.
Personal data breach (leak) – what the school should do
In the event of a personal data breach (data leak, unauthorised access, loss), the school must follow this procedure:
- Establish what happened: what data, how many data subjects, what the mechanism was
- Contain the damage: block access, change passwords, isolate the system
- Notify the CPDP within 72 hours (unless the breach is unlikely to result in a risk to data subjects)
- Notify the parents without undue delay if the breach is likely to result in a high risk (e.g. a leak of EGNs, health data or grades)
- Document everything: what happened, what measures were taken, what the outcome was
Example: If a hacker gains access to the electronic class register and downloads pupils’ names, EGNs and grades, this is a breach that must be notified to both the CPDP and the parents. If a USB stick with olympiad rankings (without EGNs) is lost, the risk is lower and may not require notification of the CPDP (but it must be documented).
Practical checklist for schools
- ✓ Maintain an up-to-date ROPA (record of processing activities)
- ✓ Conclude DPAs (Art. 28) with the providers of the electronic class register and cloud platforms
- ✓ Appoint a DPO or use an external service
- ✓ Prepare a privacy notice (Art. 13) for parents, pupils and staff
- ✓ Prepare consent declarations for photos/video
- ✓ Put up information signs for video surveillance
- ✓ Set retention periods and a deletion procedure
- ✓ Carry out a DPIA when introducing a new platform
- ✓ Train teachers and administrative staff
- ✓ Prepare a data leak response procedure
Frequently asked questions
On what legal basis do schools process pupils’ personal data?
Mainly on the basis of a legal obligation (Art. 6(1)(c) GDPR), since the ZPUO and the secondary ordinances oblige schools to keep class registers and minutes and to submit data to MON/RUO. For the educational process, public interest (Art. 6(1)(e)) also applies. Consent is required only for activities not provided for by law (photos for the website, marketing).
Is parental consent required for every processing operation at school?
No. For compulsory educational activities (enrolment, assessment, keeping the class register), the legal basis is a legal obligation under the ZPUO, not consent. Consent is required only for voluntary activities: publishing photos, participation in activities not regulated by law, marketing.
Can the school photograph children for its website or social media?
Yes, but only with the prior consent of the parent/guardian (for children under 14) or of the pupil themselves (aged 14+). Consent must be specific (for what purpose, where the photos will be published) and it must be possible to withdraw it at any time, with subsequent removal of the photos.
What rules apply to video surveillance in schools?
Cameras are permitted at entrances, in the schoolyard, in corridors and in the car park (on the basis of legitimate interest with an LIA). Cameras in classrooms, toilets and changing rooms are prohibited. Information signs, a retention period of up to 30 days and restricted access to the recordings are mandatory.
What contract must the school have with the e-learning platform?
A data processing agreement (DPA) under Art. 28 GDPR. It must include: processing instructions, security measures, management of sub-processors, assistance with data subject requests, notification of leaks, and deletion/return of data upon termination. This applies to Shkolo, Google Classroom, Microsoft Teams and any other platform.
How long can pupil records be kept?
It depends on the type of data. Main books (class registers) are kept permanently. Personal record cards and examination minutes are kept for 5 years after graduation. Health data is kept until graduation + 3 years. CCTV recordings are kept for up to 30 days. Data from e-platforms must be deleted after the pupil graduates.
What is the school’s liability in the event of a data leak from Shkolo/Google Classroom?
As the controller, the school bears primary responsibility. It must notify the CPDP within 72 hours (Art. 33) and the parents without undue delay in case of high risk (Art. 34). The processor (Shkolo, Google) is obliged to notify the school immediately and to assist. Fines are imposed on the school, but it may seek recourse against the processor.
Is a DPIA required for introducing a new educational platform?
In most cases, yes. Processing children’s data in combination with a new technology or on a large scale falls within the CPDP criteria for a mandatory DPIA. We recommend a DPIA before introducing any new platform, even if it is not formally mandatory, as it helps to identify risks and apply adequate measures.
Do you need a GDPR audit for your school?
- Full GDPR compliance audit of the educational institution
- Preparation of the ROPA, notices, declarations and internal rules
- Review of contracts with e-platform providers (DPA under Art. 28)
- Training of teachers and administrative staff
- External DPO for schools
