GDPR & Data Protection
We are transparent about how we handle your students' personal data. Here is exactly how Skolshield meets the GDPR — article by article.
Article 5(1)(f) — Integrity and Confidentiality
“Personal data shall be processed in a manner that ensures appropriate security.”
Skolshield protects student data with:
- Encrypted communication (TLS/HTTPS) for all data traffic
- Encryption at rest — encrypted storage volumes and backups
- Role-based access control — staff only see the students they are authorised to access
- Automatic session management with inactivity timeout
- Session hijacking detection, with automatic sign-out on suspected takeover
Article 5(2) — Accountability
“The controller shall be able to demonstrate that processing is performed in accordance with the GDPR.”
Every access to student data is logged automatically. Not as an add-on — it's built into the system's architecture.
Our logging covers:
- Viewing student pages and student lists
- Changes to student data
- File access — upload, download, deletion
- Permission changes
- Data exports
- All logins and logouts
This is what it looks like — the audit log, straight from the demo environment. Every access, with user and timestamp.
Article 25 — Data Protection by Design
“Data protection shall be built into the system from the start, not added afterwards.”
Skolshield's security is built as layers in the platform itself (middleware) that protect and log automatically, without individual developers having to think about it. This means:
- Logging cannot be forgotten
- Access control cannot be bypassed
- Security rules are applied consistently throughout the system
- Pseudonymisation per viewer: in the limited incident view, the names of students the teacher does not teach are masked, on the server
- Transfers when changing school mask other students in the same events (Student A, Student B) and require a harm assessment before export
Article 16 — Right to rectification
“The data subject shall have the right to obtain without undue delay the rectification of inaccurate personal data.”
An erroneous or false report is annulled by school leadership with a mandatory reason. The case remains in the history, marked as annulled, is removed from statistics and overviews, and the annulment is logged. Rectification without destroying the trail. The reporter can flag an incident as filed in error.
Article 30 — Records of Processing Activities
“Every controller shall maintain a record of processing activities.”
The Article 30 record of processing is yours, but the system supplies the material: the data processing agreement describes what data is processed and why, and the log with over 60 event types — from logins to file access and administrative changes — shows how the processing actually happens. Searchable, filterable and available to your data protection officer.
Article 32 — Security of Processing
“Appropriate technical and organisational measures shall be implemented to ensure a level of security appropriate to the risk.”
We handle data about children, which requires heightened protection. Skolshield includes:
Automatic risk assessment of every login
Flags if the same account is used from two locations within a short time
After repeated failed login attempts
Unusual access methods are flagged
Warning on unusually large amounts of data access
Ability to restrict access by country
Article 33 — Personal Data Breach Notification within 72 Hours
“In the case of a personal data breach, the supervisory authority shall be notified within 72 hours.”
The 72 hours count from discovery. Without detection, a breach can go on for weeks or months without you knowing.
Skolshield ensures you can meet the deadline:
- Security incidents are detected automatically in real time
- IT staff are notified immediately via email
- A dedicated security dashboard shows all active alerts
- Log data can be exported as supporting material for reporting to IMY
Article 34 — Communication to the Data Subject
“Where the breach is likely to result in a high risk, the data subjects shall be informed.”
During a breach, Skolshield can show exactly which students' data was affected, what type of access occurred, and from where. This makes it possible to inform the right guardians with accurate information — not a generic mass notification.
Article 5(1)(e) — Storage Limitation
“Personal data shall not be kept longer than necessary.”
Retention periods are configurable per data type, with statutory minimums built in as a floor. For municipal authorities preservation is the default, and disposal follows your records-management plan, never an automatic time limit.
Statutory chains the system models
Since 1 August 2026 new rules apply to degrading treatment (Education Act ch. 6 ss. 10–10 a): staff inform the principal about serious or repeated incidents, the principal reports them to the responsible authority, which investigates, and everything else is handled at school level. Schools must also provide student health services and document support measures. The burden of proof still rests with the responsible authority — without documentation there is no way to show the school acted correctly, whether the case stayed at school level or went further.
| Rule | What the system does |
|---|---|
| Education Act ch. 6 ss. 10–10 a, degrading treatment | Grounds are stated, the principal is informed, the report to the responsible authority is logged and the investigation is followed up. Principal's acknowledgment, the authority's inbox across all school units and a daily reminder until the report is acknowledged. |
| Education Act ch. 3 s. 7, special support | The principal is notified when a case is opened so that an investigation is ensured. The principal's decision is documented on the case. |
| Student health team minutes | Minutes are approved in the system. Decisions become actions with an owner and a follow-up date. |
| Retention and the Archives Act | Retention floors per type of responsible authority. For municipal authorities preservation is the default; disposal only follows your records management plan. |
| Transfer when changing school | Other students in the same events are masked (Student A, Student B) and a harm assessment is required before export. Moves within the municipality happen automatically on sync. |
Data Storage within the EU
All data is stored within the EU. No subprocessors outside the EU/EEA have access to student data.
Datacenter
Helsinki, Finland
Backups
Germany
Our operations: EU only
No student data with US cloud services in our operations. Files are stored in your own Microsoft 365, under your existing agreement with Microsoft.
Your Data, Your Control
The responsible authority, the municipality or the independent school, is always the data controller. Skolshield is your data processor. This means:
You decide what data is processed and why
You have full visibility into all processing via the logs
You can request data export or deletion at any time
We never process data for our own purposes
The fact that data is stored with us as a managed service does not change your ownership. It's a legal status, not a hosting question.
Data Processing Agreement
We sign a data processing agreement (DPA) with every responsible authority in accordance with GDPR Article 28. The agreement specifies:
- Which personal data is processed
- The purpose of the processing
- Technical and organisational security measures
- Procedures in case of a personal data breach
- Terms for subprocessors
Have questions about GDPR?
We're happy to answer questions about how Skolshield handles personal data.
Contact us