GDPR Compliance And Data Privacy Program For An EdTech Platform

Compliance starts with knowing what data you hold and why. We ran workshops with every team, from product and engineering to marketing and customer support, to trace how personal data entered, moved through and left the platform. Every team was involved, not just engineering and IT.

The mapping uncovered more than 140 separate processing activities, many of which nobody had documented before. It also revealed copies of student data in analytics tools, old test databases and shared spreadsheets, often kept far longer than necessary and accessible to far more staff than actually needed to see it.

Every activity was recorded with its purpose, legal basis, data categories and owner. This single, accurate map became the foundation for the rest of the programme and gave the privacy team a clear picture of risk that had never existed before. The map is reviewed twice a year, so it stays accurate as new products and features are launched across Europe.

GDPR requires organisations to keep formal records of their processing activities, and the platform had none. We turned the data map into a complete, well-structured register that met the regulator's expectations and could be kept up to date easily. It needed to satisfy both internal auditors and the regulator.

The register was built in a dedicated privacy tool rather than a spreadsheet, with named owners reminded to review their entries every six months. New products and features now trigger an automatic prompt to update the register, so it stays accurate as the platform grows instead of slowly drifting out of date again.

The completed register was one of the first documents shared with the supervisory authority. It showed clearly that the platform understood its own data, which helped set a constructive tone for the rest of the regulatory conversation and future correspondence. The register also helps the platform answer school and customer privacy questions far faster than before.

Processing children's data at scale is high risk by definition, so several activities needed a formal data protection impact assessment. We identified which processes required one and led each assessment with the relevant product and engineering teams. Each assessment involved the people closest to the data.

Assessments covered learning analytics, progress tracking, video lessons and third-party integrations with school systems. For each, we examined the risks to learners, tested whether the data collected was truly necessary and agreed practical measures to reduce those risks, such as pseudonymisation, shorter retention and much tighter access controls.

Twelve impact assessments were completed and signed off, with every recommended measure tracked through to implementation. DPIAs are now built into the product development process, so privacy risks are considered from the very start of any new feature rather than after launch. Schools have welcomed the assessments, and several now request them as part of their own procurement.

The regulator's biggest concern was how the platform gathered consent from children. Younger users were signing up without any check that a parent or guardian had agreed, which did not meet the requirements of Article 8 of the GDPR. Getting it right was essential for the whole programme.

We redesigned the sign-up journey with age checks that vary by country, as the age of digital consent differs across Europe. Where parental consent is required, parents now receive a clear, friendly explanation and verify their approval through a simple, secure process before the child's account is activated for use on the platform.

The new consent flow was reviewed by privacy counsel and tested with families before launch. Consent rates remained high, showing that doing things properly did not harm growth, and the regulator confirmed the new approach addressed its concerns fully. The same approach has since been adapted for new markets, making expansion into further countries simpler.

Personal data was being shared with 35 suppliers, including hosting providers, analytics tools and video platforms, often without the contracts GDPR requires. Each one represented a legal gap and a potential route for data to be misused or lost. Some of these relationships had not been reviewed in years.

We reviewed every supplier relationship, confirming what data was shared, where it was stored and whether it was genuinely needed. Some integrations were removed entirely, others were reconfigured to share less information, and data processing agreements with proper safeguards were drafted, negotiated and signed with all remaining suppliers.

All 35 supplier agreements were completed within the programme timeline. A new supplier onboarding process now ensures privacy checks and contracts are in place before any personal data is shared with a new provider in the future. Supplier reviews now take place every year, so contracts and safeguards stay in line with the platform's needs.

Keeping data longer than necessary was one of the issues raised by the regulator. The platform had no clear rules, so student data from accounts inactive for years was still sitting in databases, backups and analytics systems. Nobody could say exactly how long most data was being kept.

We defined a retention schedule for every category of data, balancing legal requirements, school contracts and learners' interests. Automated deletion jobs were then built with the engineering team, so data is removed or anonymised on time across every system, including backups, analytics tools and archived storage environments.

In the first run, data belonging to more than 900,000 inactive accounts was safely deleted or anonymised. The platform now holds far less personal data, reducing both its compliance risk and the potential impact of any future security incident. Storage costs also fell noticeably, a welcome financial benefit of holding far less unnecessary personal data.

Policies only work if people understand and follow them. Before the programme, no staff had received GDPR training, and many were unsure what counted as personal data or how to handle requests from users and schools. The training needed to be practical and relevant, not theoretical.

We created short, practical training modules tailored to each role, from engineers and data analysts to customer support and sales teams. Real scenarios from the platform, such as handling a parent's request to delete their child's data, made the training relevant and memorable rather than an abstract legal lecture staff would quickly forget.

Training completion reached 94% within eight weeks, up from zero. Staff now know when to involve the privacy team, and the number of data protection questions raised internally has increased, a sign that people are thinking about privacy in their daily work. Refresher training now runs every year, and new starters complete the relevant modules within two weeks.

Handling the supervisory authority's enquiry well was essential. We helped the platform respond openly and constructively, acknowledging the gaps while showing a credible, well-resourced plan to fix them within a clear timeframe. Honesty and clear evidence were at the heart of every conversation.

Regular progress updates were shared with the regulator, supported by evidence such as the processing register, completed impact assessments and the redesigned consent flow. We prepared the leadership team for each meeting, so they could answer detailed questions confidently and demonstrate genuine commitment rather than simply defending past decisions.

The authority formally closed its enquiry with no enforcement action, directly crediting the remediation programme. The platform now maintains an open relationship with the regulator and is seen as a responsible, well-run organisation in the European education sector. Leadership now treats privacy as a board-level priority, reviewing the programme at every quarterly meeting.