EdTech, e-learning and school platforms

• Regulation (EU) 2016/679 — GDPR, Articles 27 and 8
• Regulation (EU) 2024/1689 — AI Act, Annex III education
• Directive 2002/58/EC — ePrivacy
• Regulation (EU) 2022/2065 — DSA where content is hosted

Who has to appoint one

Providers established outside the Union offering learning platforms, assessment tools or classroom software to schools, universities or learners in the EU. Schools are usually controllers and the vendor a processor, but vendors that use data for product improvement or advertising become controllers for those purposes and need their own representative.

Thresholds and exemptions

No GDPR threshold. Under the AI Act, systems used to determine access to education, evaluate learning outcomes, assign students or monitor prohibited behaviour during tests are high-risk under Annex III, with obligations applying from 2 August 2026.

What must appear on the label

The representative's identity in the privacy notice and in the contractual documentation given to schools. Where AI is used for assessment, the transparency information required by the AI Act, and disclosure to learners that they are interacting with an AI system.

Marketplace fields

Public procurement in education is where this is enforced in practice: ministries and school authorities in several member states have blocked or restricted platforms over transfers, telemetry and advertising, and procurement questionnaires now ask for the representative, the transfer analysis and the AI classification.

Documentation you must hold

Article 30 records, Article 28 processing terms with schools, the Article 27 designation, a data protection impact assessment covering children's data, transfer mechanism documentation, and a clear separation between data processed on the school's instructions and data used for the vendor's own purposes. For high-risk AI: technical documentation, risk management, data governance and the conformity assessment.

Standards and testing

Not applicable to the platform, but proctoring systems raise accuracy and discrimination issues that must be evidenced, and the AI Act requires accuracy, robustness and cybersecurity levels to be declared and tested.

Language requirements

Privacy information in a form children can understand, in the language of the learners, which Article 12 requires explicitly for information addressed to a child.

When it applies

The representative before processing begins. AI Act high-risk obligations from 2 August 2026.

How long records are kept

Learner data only for the period agreed with the school, with deletion on termination. Retaining data after a contract ends for product improvement is a recurring finding.

What happens if you do not comply

Up to €20 million or 4% of turnover, and this is a sector where authorities have acted decisively because the data subjects are children and consent is not freely given in a classroom. AI Act penalties apply on top for high-risk systems, up to €15 million or 3%.

Who enforces it

Data protection authorities, education ministries as procurement decision-makers, and AI Act market surveillance authorities from 2026.

Where the boundary lies

The processor-controller line is where cases are lost: telemetry, product analytics and any advertising make the vendor a controller for those purposes, regardless of the processing agreement. Proctoring that monitors a student's face, room or keystrokes is high-risk AI and, in some designs, an emotion recognition system, which is prohibited in education under Article 5.

Questions we are asked

The school is the controller — do we still need a representative?

If you process personal data of learners in the Union as a processor under Article 3(2), you need your own representative. And for any purpose you determine yourself, you are a controller.

Is AI proctoring allowed?

Monitoring during tests is high-risk under Annex III. Systems inferring emotions in educational settings are prohibited outright under Article 5, so the design determines whether it is regulated or banned.