Training and education
Data protection for
academies and training centres
Academies manage data on adult and minor pupils, use digital learning platforms and maintain ongoing communication with families. The GDPR applies from the very first enrolled pupil.
14 years
digital consent threshold
Art. 21.2
LSSI — existing-customer exception
Art. 28
GDPR — e-learning platforms
24 h
personalised proposal
Sector challenges
General obligations for academies and training centres
Data on adult and minor pupils
Academies manage data on pupils of different ages, with specific conditions depending on the type of data and its purpose. As a general rule, where consent is required for additional processing, minors are subject to the legal representation of their parents or legal guardians. Each situation must be assessed individually.
Communications with families
Using WhatsApp, email or messaging apps to communicate with families involves processing contact data and, in the case of WhatsApp, a transfer to the USA.
E-learning platforms
Training platform providers may act as data processors or as independent controllers depending on their contractual terms. The legal relationship must be analysed with each provider and properly documented.
Images in advertising
Photographs or videos of pupils used in advertising materials, social media or the academy's website require explicit consent, separate from the enrolment consent.
Payments and direct debits
Bank details for direct-debit of fees are sensitive financial data that must be handled with appropriate safeguards and retained only for as long as necessary.
Marketing and lead generation
Sending advertising to former pupils, managing leads from social media and running acquisition campaigns each require a specific legal basis for each type of communication.
The service
What the service includes for your academy
RoPA (Record of Processing Activities)
Tailored record: pupils, families, employees and digital platforms.
Information clauses and consent
Enrolment form, image authorisation and consent for commercial communications.
Privacy policy and legal notice
Documentation for the academy's website.
Data Processing Agreements (DPA)
DPAs for e-learning platforms, payment tools and management software.
Data breach protocol
Response procedure with 72-hour notification.
Data subject rights management
Procedure for requests from pupils, families and employees.
Document management platform
Access to a private platform with documents and electronic signature.
Ongoing support
Unlimited queries. Updates in response to regulatory changes.
External DPO (if applicable)
As a general rule, private non-regulated academies and training centres are not listed in the exhaustive provisions of art. 34 LOPDGDD or art. 37 GDPR. The final requirement will depend on the scale, volume and exact nature of each entity's processing activities. Each case requires individual analysis. Independent contract.
Do you need a proposal for your academy?
Tell us the type of training and number of pupils. Proposal within 24 hours.
FAQ
Frequently asked questions about data protection in academies
Are private training academies required to comply with the GDPR?
In general, any academy that manages pupil data, issues invoices or maintains communication with families processes personal data and is subject to the obligations of the GDPR. The precise scope of those obligations depends on the type of data, the purpose and the context of the centre; an individual analysis is advisable.
Can an academy communicate with pupils or families via WhatsApp?
Using WhatsApp involves an international transfer of data to Meta (USA). The academy must disclose this in its privacy policy and verify the applicable transfer mechanism (the EU–US Data Privacy Framework if the provider is certified, or standard contractual clauses). As minors may be affected, alternative channels should be considered or, at minimum, the legal basis and transfer mechanism must be properly documented. It must never be used for commercial communications without specific consent.
Are e-learning platforms data processors for the academy?
It depends on each provider's model and contractual terms. As a general rule, providers that host and process pupil data exclusively on the academy's instructions may act as data processors (art. 28 GDPR). However, some training SaaS providers operate under their own terms and could be regarded as independent controllers. The precise legal relationship must be analysed case by case; in any event, the academy must review contracts and verify where data is stored.
Can photographs of pupils be used in the academy's advertising?
Only with explicit consent. Where pupils are minors, the consent of their parents or legal guardians will be required; the specific conditions depend on the age and context and should be assessed individually. Consent for photographs used for advertising purposes is separate from consent for the provision of the training service. It must be documented separately and the pupil must be able to withdraw it without affecting their course.
Can the academy send marketing communications to former pupils?
Only if the former pupil has consented to receive commercial communications, or if the existing-customer exception applies: the academy may send advertising for services similar to those already purchased (art. 21.2 LSSI), provided the recipient has not opted out and an easy unsubscribe mechanism is in place.
How should direct-debit payment data be handled?
Bank details (IBAN, account holder) collected for direct-debit of fees are sensitive financial data. The academy must inform the pupil or family of the processing purpose, retain them only for as long as necessary, and also comply with SEPA payment rules.
Free tool
Data protection self-check
Check in 5 minutes your overall adaptation level in personal data protection.
No email · Anonymous · No commitment
Training and education
GDPR compliance
for your academy.
An expert analyses your activity and proposes the right solution. No intermediaries.
Proposal within 24 h · info@certix.es
Legal notice: This content is for informational and educational purposes only; it does not constitute specialist legal advice. The application of the regulations to each specific case requires individual analysis.