The page to forward
For data protection officers and IT
The answers to the questions you ask before a school may start, on one sheet. The detail is in the GDPR walkthrough and in the data processing agreement, which you get on request.
The roles
| Data controller | The school or the responsible authority. You own the database, all student and staff data and the backups. |
|---|---|
| Data processor | Skolshield AB (reg. no. 559596-9287). We operate the infrastructure and our support has technical access to the running instance, which makes us a processor under Article 28 and not merely a software vendor. |
| The agreement | A data processing agreement on the SALAR (SKR) template, with an instruction appendix and a sub-processor list. No school goes live without a signed agreement. You can revoke our access without notice; a suspended service never affects your access to your data. |
| Legal basis | The processing follows from the Education Act: chapter 6 (degrading treatment), chapter 3 (extra adaptations and special support) and chapter 2 section 25 (student health). A task in the public interest and the exercise of official authority, not consent. |
Where the data is
| Hosting | Hetzner Online GmbH, data centre in Helsinki (Finland). Encrypted storage volumes, one instance per responsible authority, no shared database. |
|---|---|
| Backups | Encrypted before they leave the server, stored with Hetzner in Germany. The school is responsible for its backups; we take them and can hand them over on request. |
| Files and sign-in | In your own Microsoft 365 environment, under your own agreement with Microsoft: sign-in with the school account, documents on your SharePoint, a Teams link in the meeting. Skolshield stores no copies of your files. |
| Third countries | No transfer outside the EU/EEA in our operations. No US cloud services are used to run, store or back up the service. |
| Sub-processors | One in the standard delivery: Hetzner Online GmbH, for hosting and backups. If you choose Skolshield-managed BankID, the BankID provider is added. The list in the data processing agreement is the one that applies, and changes are announced in advance with a right to object. |
Access and traceability
| Roles | Access follows the duty role in your student register (SS12000) and updates automatically on sync. A teacher sees their own students; other students' names are masked on the server before the page is shown. No manual access list to maintain. |
|---|---|
| Authority level | On a municipal installation, central student health sees overviews without names. A child's name reaches the municipality only when the school itself lifts the case, or in a degrading-treatment case the principal has reported. Central IT never sees students. |
| Sign-in | Microsoft 365 as the base, then steps per role: a session lock with PIN, one-time codes, Microsoft Authenticator with number matching, passkeys or BankID at assurance level 3. An idle session is locked and signed out. |
| Audit log | Over 60 event types, from sign-in to an opened student page, file and printout, with user and timestamp. Searchable and filterable for your data protection officer. |
| Access-log review | A built-in review view shows who opened which student data and flags access with no link to a case, to teaching or to a granted permission. Material for a formal log review can be exported. |
| Protected Personal Data | Support for confidentiality markers and protected population registration, under the same access model and with full logging. |
Retention, breaches and continuity
| Retention | Retention periods per data type, with the statutory minimums as the floor. For municipal authorities preservation is the default and disposal follows your records management plan, never an automatic time limit. |
|---|---|
| Data subject rights | Access requests, rectification and restriction are handled with a trail in the log. We assist you within the agreed time with extracts, erasure, portability and input to your impact assessment. |
| Personal data breach | A built-in breach register under Articles 33 and 34 and an automatic processor-to-controller notice under Article 33(2), so your 72 hours count from detection and not from an e-mail. |
| If Skolshield ceases | A full export of all your data in open formats on request, a current copy in your own Microsoft 365 environment and source-code escrow that releases the system to you. Your duty to preserve records never depends on a vendor's survival. |
What we can send you today
- A draft data processing agreement on the SALAR (SKR) template, with the instruction appendix
- Sub-processor list
- A description of technical and organisational security measures
- Input to your record of processing (Article 30) and your impact assessment
- A test account on the demo instance for your own review of access and the log