GDPR at language and training academies: minimum documentation from the first student

Q: What minimum data protection documentation does an academy need from its first student?

A language, vocational or after-school tuition academy is a controller from its very first student and must have: a Record of Processing Activities with the processing operations identified (student management, invoicing, communication, marketing where applicable), an art. 13 GDPR information notice provided at the time of enrolment to the student or their parents if a minor, art. 28 GDPR contracts with the technology providers (management platform, payment tool, video-class software if used), a basic operational security policy adapted to the size (individual passwords, two-factor, encrypted backup), a breach protocol with an AEPD notification template, and a cookie policy on the website if the academy has an online presence. For students under 14, in addition, separate boxes for parental consent to image and communications.

Q: Does a small academy with few students have to comply with the GDPR the same as a large one?

Yes, with the only difference being the proportional documentary scope. The GDPR applies to any controller that processes personal data regardless of size. What varies is the extent of the documentation: a small academy can have a one-page RoPA with three entries (students, invoicing, marketing where applicable), a one-page security policy and short, clear clauses. The principles (lawfulness, transparency, minimisation, storage limitation, integrity, accountability) apply the same to an academy of five students as to one of five hundred. The AEPD has on several occasions sanctioned small academies precisely for assuming that the GDPR did not apply to them: databases without information, disclosure of data to external sales agents without consent, photos of students on social media without authorisation.

Q: Is the academy a controller or a processor if it delivers courses for companies?

It depends on the specific flow. When the academy delivers training to the employees of a client company and the company provides the employees' data (list of enrolees, contact details, possibly certificates of completion), the academy typically acts as a processor on behalf of the client company: it processes the staff data on assignment, returns it at the end of the course and does not use it for its own distinct purposes. The client company remains the controller of its employees' data. The academy is an independent controller over the data of its own commercial contacts with the company (project manager, contact person, invoicing), over its own teaching staff and over its prospects. The relationship with the client company requires an art. 28 GDPR contract with the minimum content, especially on the return of the data at the end of the course and the prohibition on reuse.

Q: Can the academy retain the student's data after the course ends?

Yes, but only for the periods justified by the various applicable legal obligations. Data linked to invoicing must be retained for the periods of the Commercial Code (six years from the last entry) and the General Tax Act (four years of general limitation, extendable depending on the case). Academic data (grades, certificates of completion, the student's file) has its own periods depending on the nature of the training (regulated training, FUNDAE-subsidised training, certificates of professionalism). Data for commercial use (newsletter, offers, communications about new courses) requires the student's valid consent and must be deleted when they unsubscribe. The professional academy documents differentiated periods per block in its retention policy, separates the active archive from the historical archive and proceeds with secure destruction when all the relevant periods have expired.

A language, vocational training or after-school tuition academy is a controller of personal data from its very first enrolled student. Identifying data, contact data, financial data, in many cases health data (a minor's allergies in in-person classes), academic data and, when the offering includes digital platforms, also online behavioural data. The GDPR applies to all of it, regardless of the size of the centre.

This guide explains the minimum proportional documentation that any academy should have available from day one, under the GDPR (Regulation EU 2016/679), the LOPDGDD (Organic Law 3/2018) and the LSSICE (Law 34/2002) when the academy has a website or digital channel.

The typical processing operations of an academy

Almost any academy comes down to four or five processing operations:

Processing	Typical data	Legal basis
Enrolment and student management	Name, ID number, contact, grades, attendance, guardian for minors.	Performance of a contract (6.1.b)
Invoicing and tax obligations	Data for issuing invoices, IBAN, withholdings.	Legal obligation (6.1.c)
Communication with families (minors)	Data of legal guardians, progress reports, authorisation for outings.	Performance of a contract (6.1.b)
Marketing and prospecting	Newsletter subscribers, form leads, former students.	Consent or legitimate interest (6.1.a/6.1.f) + art. 21 LSSICE
Teaching staff	Employment data, payroll, training, qualifications.	Employment contract + legal obligation (6.1.b + 6.1.c)

Minimum proportional documentation

A small or medium-sized academy reasonably complies with these documentary blocks, without over-engineering:

Record of Processing Activities (RoPA): one page, four or five entries, with the information required by art. 30(1) GDPR.
Information notices: one for the adult student, another for the minor student (given to the parents or guardians), one for teaching staff candidates and the website privacy policy.
Sheet of differentiated consents at enrolment for optional processing operations: image of the student on social media and the website, future commercial communications, optional digital platforms, disclosure to allied sales agents (best avoided, but if it exists it must be documented).
Art. 28 GDPR contracts with relevant technology providers: management software (academy CRM/ERP), payment gateway, video-class tool if the academy teaches online, email marketing platform, external accounting firm.
Operational security policy: one or two pages with the real measures (individual passwords, two-factor, encrypted backup, management of personnel onboarding and offboarding with system access).
Breach protocol: two paragraphs on who assesses, in which cases the AEPD must be notified within 72 hours and how.
Cookie policy on the website, if the academy has an online presence.

Information notice for students: what it must contain

The art. 13 GDPR notice is provided at the time of enrolment, ideally integrated into the enrolment document or as a signed annex. Minimum content:

Identity of the controller (the academy, with tax ID and address) and contact details of the Data Protection Officer if one has been appointed.
Specific purposes: academic management of the student, invoicing, communication with the family for minors, administrative communications about the course and, where applicable, assessment and issuance of certificates.
Legal bases: performance of the training contract for academic management, legal obligation for invoicing, express consent for marketing.
Usual recipients: external accounting firm, management platform and, where applicable, FUNDAE if the training is subsidised, tax authorities where applicable.
International transfers if the tools used operate outside the EEA (typically yes when Google Workspace, Microsoft 365, Mailchimp or Zoom is used).
Retention periods per block (academic, tax, civil).
Rights of the student (or of the parents if a minor) and how to exercise them.
Reference to the right to lodge a complaint with the AEPD.

Minors at academies: the specific regime

An academy that works with minor students triggers an additional regime. Critical aspects:

Age to consent: art. 7 LOPDGDD sets it at 14. Below that, parents or guardians consent; above it, in many processing operations the minor can consent.
Parental consent for the enrolment of the under-14 (for what is not covered by performance of a contract), communication with the family, image authorisation, authorisation to use optional platforms.
Custody and separation: the academy must have a clear protocol for cases where the parents do not live together (enrolment, communication with the family, collection of the minor, specific decisions). It is governed by the regime of parental authority and custody.
Health data of the minor (allergies, medication, special needs) when relevant to the activity: mandatory communication for safety reasons, custody restricted to staff with a direct function.
Image of the minor: the regime of the right to one's own image applies (Organic Law 1/1982). Written, specific, withdrawable consent.

Marketing and former students: how to do it right

The base of former students is one of the most valuable commercial assets of an academy. Operational rules:

Commercial email sending to former students may rely on art. 21.2 LSSICE if the data was obtained in a prior contractual relationship and the sending relates to courses similar to those already contracted.
For sendings about non-similar products (switching from a language academy to exam-preparation courses, for example), the former student's express consent is required.
The minor student whose enrolment was managed by the parents did not automatically consent to personal commercial communications upon reaching adulthood: if the academy wants to keep contacting them, it should refresh the consent.
Each commercial sending includes a simple and free opt-out mechanism.
Disclosure of data to related companies (publishers, associated academies, partner courses) requires express and independent consent.

"In an academy, the GDPR well applied translates into a clear enrolment sheet, an information notice provided and signed, and two or three specific consents for uses that go beyond the contracted training. You do not need a hundred-page manual: you need a system that is respected every day."

Mario P. Talamillo · Managing Partner, Certix®

Management platform and technology providers

The modern academy usually depends on several SaaS tools that process student data: an integrated management platform (CRM/ERP), videoconferencing software (Zoom, Google Meet, Microsoft Teams), a payment platform, an email marketing tool, cloud storage of materials. Each one is a data processor and requires an art. 28 GDPR contract.

Critical points when contracting:

Version suitable for minors' data where applicable (education versions of Google Workspace, Microsoft 365).
DPA signed and archived.
Verification of international transfers (Data Privacy Framework for US providers).
Procedure for the return of the data when the provider's service ceases.

Minimum checklist for the academy

RoPA with the real processing operations.
Information notices for the adult student, the minor student (to parents) and teaching staff.
Sheet of differentiated consents at enrolment.
Art. 28 GDPR contracts with the management platform, payment gateway, video-class tool, email marketing and external accounting firm.
Operational security policy adapted to the size.
Breach protocol and AEPD notification template.
Privacy policy and cookie policy on the website, with a correct LSSICE banner.
Protocol for managing the student's image with an exclusion list and a withdrawal procedure.
Retention policy per block and a secure destruction procedure.

Frequently asked questions

What minimum data protection documentation does an academy need from its first student?

A RoPA with the processing operations identified, an art. 13 GDPR information notice at enrolment, art. 28 GDPR contracts with technology providers, a basic security policy, a breach protocol and a cookie policy on the website. For under-14s, separate boxes for parental consent.

Does a small academy with few students have to comply with the GDPR the same as a large one?

Yes, with a proportional documentary scope. The GDPR applies regardless of size; what varies is the extent. The principles (lawfulness, transparency, minimisation, storage limitation) are the same. The AEPD has sanctioned small academies precisely for neglecting this point.

Is the academy a controller or a processor if it delivers courses for companies?

When it delivers training to employees with data provided by the client company, it is usually a processor on behalf of the company. The company remains the controller. The academy is an independent controller over its own commercial contacts, staff and prospects. The relationship with the client company requires an art. 28 GDPR contract.

Can the academy retain the student's data after the course ends?

Yes, for the justified periods: invoicing (Commercial Code 6 years, General Tax Act 4 years), academic ones depending on the nature of the training, civil ones (5 years, art. 1964 Civil Code). Marketing only while the consent lasts. A policy differentiated per block is the tool to manage it cleanly.

This content is for informational purposes only and does not constitute legal advice. The application of regulations to each specific case requires individual analysis. Spanish regional sectoral regulations may extend or modify deadlines and requirements.

Do you want to sort out your academy's GDPR compliance without over-engineering it?

At Certix we assign you an expert in compliance for the training sector. No sales intermediaries, no generic templates.

Speak to a specialist