Privacy and LGPD (Brazilian General Data Protection Law) for schools, universities, and educational groups.

A Privacy Tools It supports educational institutions in protecting the data of students, parents/guardians, and staff, with special attention to the data of children and adolescents and the new digital regulations.

Illustration of the Training module. Privacy Tools
Illustration: LGPD as a priority for the public sector.

Why does the LGPD (Brazilian General Data Protection Law) require special attention in education?

Educational institutions process data on children and adolescents, which... LGPD It protects, with its own rules (article 14), in addition to health, financial, and academic performance data of students and families. Educational platforms, academic systems, providers, and recruitment campaigns expand the flows, and the Digital ECA reinforces the duties of those who offer digital services to minors.

A Privacy Tools It supports the institution by mapping data processing activities by unit and educational level, registering consent from guardians, assisting data subjects, evaluating platforms and providers, and training teams that handle data daily.

Advantages for your institution

Illustration: advantages of Privacy Tools for public institutions

What does the LGPD (Brazilian General Data Protection Law) require of educational institutions?

Schools, universities, and educational groups process data on children, adolescents, adult students, guardians, teachers, and staff for many years and across numerous systems: enrollment, finances, performance, school health, library, learning platforms, cameras, and transportation. LGPD Article 14 is dedicated to children and adolescents: treatment in their best interest, specific and explicit consent from one of the parents or guardians for children's data, clear and accessible information for the child audience, and a prohibition on conditioning participation in activities on the excessive collection of data. Health and biometric data of students are sensitive (Article 11). In 2025, the ECA Digital (Law 15.211/2025) It added obligations for digital products and services used by minors, and institutions with European students or international programs are included in the GDPR.

Obligations that weigh most heavily on the operation.

  • Consent of the person in charge for children's data, registered and revocable, by purpose (image, health, activities, communication).
  • Sensitive data school health services, reports, access biometrics, and cafeteria.
  • Learning platforms and applications from third parties, who are operators and need evaluation.
  • Long retention academic transcripts and documents, within a timeframe defined by regulations and purpose.
  • Rights of parents and students with authentication, including in custody disputes.
  • Capacity of teachers, secretaries and support staff.

Typical risks of the sector

Photos and videos of students on social media without valid consent; health data stored on paper forms and spreadsheets; learning platforms with terms that do not protect the institution; biometric access and cafeteria usage without impact assessment; communication with parents/guardians through uncontrolled channels; and school records stored indefinitely.

How Privacy Tools supports schools, universities and educational groups

Results in education

O Farroupilha CollegeThe school, with 3.500 students and 15 data points from data subjects, had its LGPD (Brazilian General Data Protection Law) project recognized with the National Educational Management Award and the SINEPE/RS Innovation Award. Bom Jesus Educational Group, the organization that maintains FAE and Colégio Bom Jesus, has structured the program since 2019, and the Unicap, with 10 students, optimized the relationship with the principals. See also the entry consent from the glossary.

Do you have any questions?

1. Does the school need consent to process student data?

For the educational activity itself, the legal basis is usually the execution of the contract and compliance with legal obligations. For children's data for purposes beyond that (image, communication, extracurricular activities), Article 14 requires specific and explicit consent from one of the parents or guardian, recorded and revocable.

Yes. Use of images is considered processing of personal data and, for children, depends on the consent of the person responsible for the purpose, with the possibility of revocation. The Consent Management system records and renews these authorizations each school year.

Biometric data is sensitive and requires the application of Article 11, including impact assessment and minimization. The institution must evaluate alternatives and document the decision in the RIPD (Report on Impact on Data Protection), generated from the Data Mapping.

The school, as the data controller, is responsible for the data processing carried out by the platforms on its behalf. It is necessary to evaluate these platforms, review contracts, and document the sharing of information; Third-Party Risk Management structures this process.

For the period required by educational regulations and the purpose of each document, as defined in the mapping. Documents that are not required to be kept must have a disposal deadline recorded in the processing activity.

Is your institution ready to structure privacy governance?

Request a demo from our team and see the platform in the context of your educational institution.

Platform screen Privacy Tools: dashboard with treatment activities, assets, consents, incidents and risks