What happened (summary of an anonymised case)

A European boarding school operated a popular exchange program with partner schools in other EU countries and the UK. Student travel, medical and academic information was shared through a cloud-based education platform provided by a major international vendor.

When one family requested a copy of all personal data held about their child, the school discovered that much of the information was stored and processed directly by the vendor, in data centres outside the country. The school could download some basic records, but could not see or explain how the platform used analytics, logs, or metadata about the student’s activity.

At the same time, media reports highlighted EU privacy complaints against large cloud providers used in schools, and a national data-protection authority announced enforcement action over the way a well-known education suite handled children’s data. Parents began asking whether the boarding school’s use of cloud tools and cross-border transfers was compliant with GDPR and local guidance.

The school had not set out to ignore privacy law; it simply treated the platform as a neutral “tool”. The incident exposed gaps in contracts, documentation, and governance around student data used for learning, communication and travel.

Why this matters in a boarding context

• Boarding schools hold more data, for longer: Travel details, host-family contacts, guardianship, visas, medical plans, behaviour notes and leave records all sit alongside academic data.
• Cloud platforms blur the line between “school” and “vendor”: Advocacy groups have criticised contracts where big technology companies shift GDPR responsibilities onto schools that cannot realistically audit the service.
• Cross-border students mean cross-border data: Exchange programs, overseas parents and multi-campus schools often involve transfers between countries and legal regimes.
• Parents always expect someone is clearly accountable: In a crisis, families rarely distinguish between the school and its suppliers – they expect the school to know who has what data and why.
• Reputation and trust are at stake: A single complaint about mishandled data can undo years of work building confidence with international families and agents.

Practical reflections for boarding teams

1. Map your student-data “ecosystem”: List all platforms that hold student information (learning, behaviour, pastoral, travel, communication). Note where the data is hosted and who the vendor is.
2. Clarify who is the data controller: Work with your legal or data-protection lead to understand whether the school, the vendor, or both are acting as controllers or processors for each system.
3. Review contracts and DPAs, not just features: Ensure Data Processing Agreements cover children’s data, cross-border transfers, sub-processors, and how access requests will be handled in practice.
4. Align exchange-program workflows: When students travel to partner schools, check that consent forms, medical information, emergency contacts and data-sharing terms are consistent across institutions.
5. Practice responding to an access request: Run a tabletop exercise: if a parent asked for “all data you hold on my child”, who would coordinate the response and how would vendors be involved?
6. Communicate simply with parents: Provide clear, jargon-free explanations of which major platforms you use, what they do, and how they protect student data.

Policy notes to revisit

• Data-protection policy for boarding students, including cross-border exchange programs and overseas trips.
• Register of third-party platforms and vendors used with student data, including hosting regions and sub-processors.
• Standard contractual clauses and Data Processing Agreements with cloud providers.
• Parent and student privacy notices, especially for international families and minors.
• Internal roles: who is responsible for data-protection oversight in boarding, and how they work with IT and academic leaders.

Sources & further reading

This case study is informed by recent European reporting and decisions on cloud platforms used in schools, including privacy complaints against Microsoft 365 Education and related rulings by data-protection authorities. For example, Reuters reported concerns that a major provider was “shifting its responsibilities for children’s personal data onto schools who are not equipped to cope”, based on complaints lodged by privacy group NOYB in Austria. TechCrunch and other outlets have also covered EU investigations into the transparency and lawfulness of education-focused cloud suites.

Boarding leaders should monitor guidance from their national data-protection authorities, sector associations and reputable legal commentators when reviewing contracts with large technology providers.

Your Privacy Expert is a leading international data privacy law firm with experience in exactly this topic.
Boarding School Software Pty Ltd has retained Your Privacy Expert, led by Yurii Beliaiev, and he is on call and reviews international data and privacy arrangements for our platform.  Schools we work with may negotiate preferential introductory services.
One well-considered document can make all the difference.