DPO DPO Israel
Open as Markdown

DPO for Education
Privacy for minors.

Schools, kindergartens, education networks, boarding schools, higher education and assessment centers process data on minors — a special-sensitive category in every privacy framework. Outsourced DPO for educational institutions: compliance with Amendment 13 + Ministry of Education circulars, parental consent management, education app selection with DPA, and procedures for psycho-didactic assessments and sensitive data.

Databases

10 typical education-institution databases

DatabaseSensitivity
Student file High
Assessments & achievements High
Psycho-didactic assessments Special-sensitive
Parents Medium
Student health Special-sensitive
Discipline & events High
Special needs students Special-sensitive
CCTV at the institution Medium-High
Education app systems Varies
Teacher file High
Unique issues

Six issues unique to education

Parental consent

Collecting data on minors under 16-18 (depending on data type) requires parental consent. New app in the classroom? Parent chat? Climate survey? — each has different consent requirement.

Education apps and third parties

Institutions using Google Classroom, Zoom, Mashov, Ofek Hadash, or education apps — transfer minor data to external companies. Requires DPA + consent documentation.

Psycho-didactic assessments

Psychological data on a minor is most-sensitive. Storage, access permissions, system sharing — each requires documentation and special caution.

CCTV in kindergartens and schools

Delicate legal issue. A camera in a kindergarten classroom — who sees? Why? Who has access? Ministry of Education has specific circulars on this.

Mailing to parents

School mailing system, WhatsApp parent groups, newsletter publication. Falls under spam law and Communications Law — sometimes specific consent required.

Sharing between education network and school

Data flowing between education network, school, local education authority, and Ministry of Education — must be documented with clear legal basis.

Who must

Which education institutions must have a DPO?

Private kindergartens

High

Data on minors at young age, cameras, parent apps, development documentation

Public schools

High — part of authority

Part of local authority = public body = automatic DPO via authority

Private schools

High

Processing data on minors at scale, apps, assessments, educational psychology

Education networks

Very high

Hundreds to thousands of students, central system, sharing between branches, SaaS vendors

Boarding schools

Very high

Data on minors residing at the institution — education + health + welfare combined

Higher education

High

Universities = public body. Private colleges = significant scale

Psycho-didactic assessment centers

Very high

Psychological data = special-sensitive, on minors = doubly sensitive

Enrichment classes / camps

Medium-High

Depends on size. Camp network with 5,000 children = required

Frequent questions from education institutions

Small private school — needs a DPO?
If 200+ students, or psychological assessments / special education / mental health work — yes, scale + sensitivity = required. School with 50 students without sensitive areas — borderline. Better to consult.

How to handle parental consent?
Principle: for every specific data collection, specific consent. At year start, customary to give each parent a comprehensive consent form — site photos, app communication, research participation, sharing with external companies. The form must be clear, purpose-based, with right to revoke.

App like Mashov — who is responsible?
A Ministry of Education system — regulatory responsibility is theirs. But — improper use (uploading data that shouldn’t be uploaded, wrong disclosure) — is on the school. Every external system requires DPA + use documentation.

Do you have education experience?
Yes. We work with private education networks, kindergartens, and special education institutions. DPIA for new apps, DPA management with education SaaS vendors, and parent inquiry response — all part of the service.

What about public schools?
A public school is part of the local authority. The authority’s DPO handles the school. See DPO for Local Authorities. Private education network or independent school — different.

Psycho-didactic assessments — what are the requirements?
Psychological data on a minor = special-sensitive. High security storage, access limited to school psychologist/counselor only, export only to signed parent, deletion after defined period. Specific procedure we help build.

How much does it cost?
Private kindergarten / small school — 5,000-8,500 ILS/month. Mid school (300-800 students) — 9,000-14,000 ILS/month. Large education network — 14,000-25,000 ILS/month. Higher education institution — by size and complexity.

Education institution managers — let's talk.

30-minute call, sized to institution and type, with adaptation plan.

Book a call