Is my academy's management software (Classlife, Wuolah Academy, AcademiaApp, etc.) a data processor?

Yes. Any SaaS academy management software that hosts student data (enrolments, attendance, grades, communication with families, invoicing) processes that data on behalf of the academy, which is the controller. The software provider acts as a data processor under art. 28 GDPR and must sign with the academy a Data Processing Agreement containing the content of art. 28(3): subject matter, nature and purpose of the processing, types of data, confidentiality of the provider's personnel, security measures, list of sub-processors (typically the cloud provider), breach notification, assistance for data subject rights, international transfers if any and return of the data when the service ceases. Professional providers in the sector offer this DPA as an addendum incorporated into their terms; those that do not offer it raise a serious compliance problem that should be resolved before continuing with them.

Academy management software: the art. 28 GDPR contract many academies lack

Q: What happens to the student's data when the academy switches management software?

It is the most delicate moment of the processor regime. Art. 28(3)(g) GDPR requires the outgoing provider to return to the controller (the academy) the personal data processed on its behalf, or to allow its full export, before proceeding with secure destruction. Applied to the switch of management software, this means: the academy must be able to export all the data in a structured and usable format (CSV, Excel, JSON, native provider export) before terminating the contract with the outgoing provider; the outgoing provider must certify in writing the deletion of the data in its systems after the handover; the new provider receives the data over a secure channel and signs its own DPA. The frequent mistake is to terminate the contract without exporting first: the academy is left with no student history, no grades, no past invoicing and no documentation of the training activity. The AEPD has indicated that a provider that refuses to return the data before deleting it breaches art. 28(3)(g).

Q: And if the management software is hosted in the United States or has servers outside the EEA?

It triggers the Chapter V GDPR regime on international transfers. The academy must verify the legal basis of the transfer: if the US provider is enrolled in the Data Privacy Framework, the transfers are covered by Adequacy Decision 2023/1795. If it is not enrolled in the DPF, it is necessary to operate with Standard Contractual Clauses (SCC) signed between exporter and importer and, in line with the Schrems II judgment, a documented Transfer Impact Assessment assessing whether the safeguards are sufficient given the legal framework of the destination country. For academies with minors, it is also advisable to verify that the contracted version of the software is suitable for minors' data and that the provider offers reinforced safeguards (European residency configuration where available, encryption at rest with a key under the academy's control, limitation of secondary uses).

Q: What risks does the academy take on if the software provider suffers a security breach?

The academy, as controller, remains responsible before the AEPD and before the affected students and families, even though the breach occurred in the processor's systems. The way to mitigate the risk is threefold: contractual (the DPA with the provider includes an express breach notification deadline, typically 24-48 hours, and minimum information for the communication), technical (verify that the provider maintains reasonable certifications such as ISO 27001 or SOC 2, offers encryption in transit and at rest, mandatory two-factor for administrators) and procedural (the academy has its own breach protocol with an AEPD notification template to activate within 72 hours of becoming aware). When a provider breach arrives, the academy must assess the risk to those affected, record the incident internally, notify the AEPD where appropriate (art. 33 GDPR) and, if the risk is high, communicate to those affected (art. 34 GDPR).

Management software is the central technological piece of any modern academy: it hosts the student database, manages enrolments and withdrawals, records attendance and grades, automates communication with families, integrates invoicing and maintains the academic history. Across that infrastructure the personal data of students, families and teaching staff travels daily. The relationship between the academy and the software provider is subject to art. 28 GDPR and yet it is one of the points where the most academies fail to comply without realising it.

This guide explains how to regulate that relationship under the GDPR (Regulation EU 2016/679) and the LOPDGDD (Organic Law 3/2018): what document to sign, what minimum content it must have, how to manage international transfers and how to proceed when switching provider or in the event of a security breach.

The software provider is a data processor

Any SaaS academy management software that hosts student data, manages communications with families, processes payments or records grades is processing personal data on behalf of the academy. That automatically makes it a data processor within the meaning of art. 28 GDPR.

What the provider decides on its own (the architecture of its product, the features, the roadmap, the technical measures) does not change that role: it executes the processing following the instructions of the academy, which is the party that decides which students are enrolled, what data is processed, for what purposes and for how long.

The DPA: what the academy must sign with the provider

Art. 28(3) GDPR requires the controller-processor relationship to be governed by a contract or other binding legal act with a minimum content. Applied to management software:

Clause	What it must state
Subject matter and duration	Provision of the software service during the academy's subscription, without use of the data for the provider's own purposes.
Nature and purpose	Hosting and processing of the student data and academic operations in accordance with the contracted features.
Types of data and data subjects	Identifying, contact, academic, financial, family data for minors; students, parents, teaching staff.
Provider personnel	Confidentiality by contract, least-privilege principle in access to client data.
Security measures	Encryption in transit and at rest, two-factor for administrators, access logs, backups, certifications (ISO 27001, SOC 2 where applicable).
Sub-processors	Accessible list (cloud, monitoring, support), mechanism for notifying changes, academy's right to object.
International transfers	Identification of countries outside the EEA, basis for the transfer (DPF or SCC + TIA).
Assistance for rights	Technical features to export, delete and rectify a student's data when requested through the academy.
Breach notification	Specific deadline (24-48 hours) and procedure for collaboration with the academy.
Return on termination	Full export of the data in a usable format before termination, with certification of subsequent deletion.

The professional provider offers this DPA as an addendum incorporated into its general terms, downloadable and signable from the administration panel or available on request. If the provider does not offer it, the academy must expressly request it; if it refuses, switching provider is worth considering.

Switching provider: the most critical phase

Switching management software is one of the moments where the most compliance is lost if it is not managed in an orderly way. Procedure:

Complete inventory of the data at the outgoing provider: list of students, academic histories, attendance, grades, invoicing, communications with families, configurations, custom templates.
Full export in a usable format: CSV, Excel, JSON, native product export, download of PDFs of the certificates. Integrity verification before closing the outgoing contract.
Import to the new provider with verification that all records have arrived correctly.
Signing of the new provider's DPA before starting operations.
Written certification of deletion by the outgoing provider, archived at the academy.
Communication to families if the change means a change of platform visible to them (new access URL, new communication process), ideally with reasonable notice.
Update of the academy's RoPA with the new provider and its sub-processors.

"An academy's most expensive mistake is not choosing the wrong management software: it is not signing the DPA with it and finding that out the day a provider breach arrives. The AEPD asks first about the contract; the provider invokes it to limit its liability; and the academy that does not have it is left alone bearing the consequence."

Mario P. Talamillo · Managing Partner, Certix®

International transfers: how to verify them

Many management software products, especially the more internationally widespread ones, host data or process part of the infrastructure outside the European Economic Area. Verification:

Identify the destination country of the data: the US is the most frequent case; others may be the United Kingdom, Switzerland, India, the Philippines (offshore support).
Verify the basis for the transfer:
- US: check active enrolment in the Data Privacy Framework at dataprivacyframework.gov.
- United Kingdom and Switzerland: there are adequacy decisions from the European Commission.
- Other countries without adequacy: Standard Contractual Clauses + a documented Transfer Impact Assessment.
Document the verification in the RoPA with a date and annual re-verification.
Inform families in the art. 13 GDPR notice about the transfer and the basis.

Security breaches: what the academy must be able to execute

Art. 33 GDPR requires the controller to notify the AEPD of any security breach that may pose a risk to the rights and freedoms of those affected, within a period not exceeding 72 hours of becoming aware of it. When the breach occurs at the provider (processor), the academy (controller) must be able to activate the procedure immediately.

Key elements:

Rapid notification by the provider: an express deadline in the DPA (24-48 hours).
Minimum initial information: nature of the incident, systems affected, categories of data compromised, estimated scope, immediate measures.
Internal assessment: the academy assesses whether the breach may pose a risk to those affected and decides on notification to the AEPD.
Internal record of the breach with a root-cause analysis, measures adopted and lessons learned (art. 33.5 GDPR).
Communication to those affected when the risk is high (art. 34 GDPR), with a description of the situation, contact of the DPO if there is one and recommendations to mitigate the effect.

Minimum checklist for the management software

Art. 28 GDPR DPA signed and archived with the provider.
Provider's list of sub-processors accessible and up to date.
Documented verification of international transfers (DPF or SCC + TIA).
Data export and deletion features for data subject rights requests, tested.
Express breach notification deadline (24-48 hours) and collaboration procedure.
Documented procedure for switching provider with export, certification of deletion and signing of a DPA with the new one.
RoPA updated with the provider and its sub-processors.
Internal configuration of the software with the least-privilege principle: each academy user only sees what they need.

Frequently asked questions

Is my academy's management software a data processor?

Yes. Any SaaS software that hosts student data processes that data on behalf of the academy and is a data processor (art. 28 GDPR). A DPA must be signed with the content of art. 28(3). Professional providers offer this DPA as an addendum to their general terms.

What happens to the student's data when the academy switches management software?

Art. 28(3)(g) GDPR requires the outgoing provider to return the data before destroying it. The academy must export everything in a usable format before terminating, import to the new provider with integrity verification, require written certification of deletion and sign a DPA with the new provider.

And if the software is hosted in the United States or has servers outside the EEA?

It triggers Chapter V GDPR. If the US provider is enrolled in the Data Privacy Framework, the transfers are covered. If it is not enrolled, it is necessary to operate with Standard Contractual Clauses and a documented Transfer Impact Assessment. Verify at dataprivacyframework.gov, document it in the RoPA, inform families.

What risks does the academy take on if the software provider suffers a breach?

The academy remains responsible before the AEPD and those affected. Mitigation: contractual (24-48h notification deadline in the DPA), technical (certifications, encryption, two-factor) and procedural (its own protocol to notify the AEPD within 72h and those affected if the risk is high).

This content is for informational purposes only and does not constitute legal advice. The application of regulations to each specific case requires individual analysis. Spanish regional sectoral regulations may extend or modify deadlines and requirements.

Have you signed the art. 28 GDPR DPA with your management software?

At Certix we assign you an expert in compliance for the training sector. No sales intermediaries, no generic templates.

Speak to a specialist

Academy management software: the art. 28 GDPR contract many academies do not have