GDPR in schools and universities: a practical guide for student data

In brief:

• Attendance records and signatures are personal data. The GDPR applies to them like to any other student record.
• Choose the lawful basis before collecting anything. For attendance, it is rarely consent: public task, legal obligation or contract usually fit better.
• The GDPR sets no fixed retention period. You define it per purpose, based on your legal and funding obligations, and you document it.
• Your attendance or campus app vendor is a processor. You need a data processing agreement with it.
• A personal data breach must be reported to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to create a risk for the people concerned.

Every school, university and training provider processes personal data every day: enrolment files, timetables, grades, and above all attendance records. GDPR applies to all of it. Yet most guides stay abstract, or focus on primary schools and pupils. This one takes the example most institutions deal with at every session, attendance and signature data, and walks through what the law actually asks of you.

It covers the EU GDPR and the UK GDPR, which remain very close. It is a practical overview, not legal advice: your data protection officer has the final word on your own processing.

Does GDPR apply to schools and universities?

Yes. The GDPR applies to any organisation that processes personal data of people in the European Union, and the UK GDPR, together with the Data Protection Act 2018, applies in the United Kingdom. Public universities, private schools, colleges, training providers and corporate academies are all covered.

In practice, the institution is the controller: it decides why and how student data is processed. The software vendors it uses, for attendance, e-signature, a learning platform or a campus app, are processors acting on its instructions.

What counts as student personal data

Personal data is any information relating to an identified or identifiable living person. In a school or university, that includes:

• Identity and contact details: name, student number, email, phone.
• Academic records: enrolment, course, grades, assessments.
• Attendance data: presence, absences, late arrivals, the time and place of each signature, justifications for absence.
• Electronic signatures on documents such as enrolment contracts or internal rules.
• Usage data from digital tools: logins, notifications read.

Some data belongs to special categories under Article 9, which require stronger protection and a specific legal condition: health data (a medical certificate justifying an absence), biometric data used to identify a person, or information revealing religious beliefs. A medical note attached to an absence is therefore not an ordinary attachment: limit who can see it.

Choosing a lawful basis for attendance data

Article 6 lists six lawful bases. For student data, four are relevant.

Consent is rarely the right basis for attendance. It must be freely given, and a student cannot really refuse to have their attendance recorded when it is a condition of the course. Consent is better suited to optional uses, such as photos for a brochure.

Controller, processor and the data processing agreement

When you use a digital tool to take attendance or collect signatures, the vendor processes student data on your behalf. Article 28 requires a written contract, the data processing agreement, which sets out:

• the purpose and duration of the processing and the types of data;
• the processor's obligation to act only on your instructions;
• security measures and confidentiality;
• the conditions for using sub-processors;
• assistance with data subject requests and breaches;
• deletion or return of the data at the end of the contract.

Before choosing a vendor, also check where the data is hosted, what security certifications it holds and how long it keeps data after termination. Edusign's security page sets out its hosting, certification and data protection measures.

Do you need a data protection officer?

Under Article 37, a data protection officer (DPO) is mandatory for public authorities and bodies, which covers public universities and state schools. It is also mandatory for private organisations whose core activities involve large-scale regular monitoring of individuals or large-scale processing of special categories of data. Many private training providers are not strictly required to appoint one but choose to, given the volume of learner data they handle.

The DPO advises on compliance, monitors it, is consulted on data protection impact assessments and is the contact point for the supervisory authority: the ICO in the UK, or the national authority in each EU country.

Retention periods: how long to keep attendance records

The GDPR does not set a number of years. Article 5 requires that data be kept no longer than necessary for the purpose. For attendance records, the right period depends on why you keep them:

• Running the course: as long as the student is enrolled and results can be contested.
• Proving delivery to a funder or regulator: as long as that body can audit you, as set out in your funding agreement or regulations.
• Accounting and contractual claims: the limitation periods of your national law.

Document each period in your record of processing activities and your retention schedule, then apply it. The most common failure is not the choice of period but the absence of deletion: records kept forever "just in case". Edusign stores signed attendance records in a secure electronic archive, which lets you keep proof for the period you set and find a record when an auditor asks for it.

Transparency: what your privacy notice should say

Students must be told how their data is used, in clear language, at the time it is collected. For attendance, the notice should state:

• who the controller is and how to contact the DPO;
• what attendance data is collected (including time and location of signatures, if applicable);
• the purpose and the lawful basis;
• who receives it (teaching staff, administration, funders);
• how long it is kept;
• the rights of the student and how to exercise them.

Handling access requests

Students have the right to access their data under Article 15, including their attendance history. You must respond without undue delay and within one month, which can be extended by two further months for complex or numerous requests, provided you inform the student within the first month.

Digital attendance makes this simpler: the history is in one place and can be exported, instead of scattered across paper registers in several offices. Before sending, check that the export does not reveal data about other students.

Handling a data breach

A breach can be a lost laptop, an email with a class list sent to the wrong recipients, or a cyber attack. The steps:

1. Contain the breach and secure the affected systems.
2. Assess the risk to the people concerned.
3. Notify the supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk (Article 33).
4. Inform the students concerned without undue delay if the risk to them is high (Article 34).
5. Record every breach internally, even those you do not report.

A checklist for attendance and signature data

• Attendance processing is listed in the record of processing activities.
• A lawful basis is chosen and documented for it.
• A data processing agreement is signed with each vendor.
• Health data attached to absence justifications has restricted access.
• A retention period is set and deletion actually happens.
• The privacy notice mentions attendance data.
• Staff know how to handle an access request and a breach.

For definitions of the terms used here, see our GDPR glossary entry.