More than 30 schools trust us as their Data Protection Officer
We are the Data Protection Officer of more than 30 schools in Spain: state-funded private schools (colegios concertados) and the organisations that own school networks. We know how a school works day to day: enrolment, learning platforms, photos from school trips, families asking for information and inspections by the Spanish Data Protection Agency (AEPD).
Spanish law requires every school to have a Data Protection Officer. Our job is to make that role work in practice: management, the school office and teachers know what to do, and the school can prove it if anyone asks.
The problems we solve in schools
- Learning platforms. Google Workspace for Education, Microsoft 365 and family communication apps require a contract, an impact assessment and the right configuration. The AEPD has already fined a school for rolling out Google Workspace without those safeguards.
- Pupils’ images. Photos and videos on the website, on social media, in school magazines or filmed by families at school events.
- Enrolment and forms. Privacy notices, consents and paperwork requested from families, without asking for more data than necessary.
- Health data and special educational needs. Medical reports, allergies, guidance and support measures, accessible only to those who need them.
- Communication with families. Messaging groups, teachers’ email and the use of personal devices.
- CCTV, access control and data breaches. From the camera sign to what to do if a list or a laptop is lost.
- Whistleblowing channel. Schools with 50 or more employees must have one under Law 2/2023. We set it up and act as the manager of reports within the school’s committee.
What our school DPO service includes
- Initial assessment of the school and a prioritised compliance plan.
- Documentation tailored to the school: record of processing activities, enrolment notices, image consents and supplier agreements.
- Training for teachers and staff, live or recorded, with a certificate of attendance.
- Handling requests from families and the AEPD: access requests, complaints and formal requirements, on time.
- Annual review and ongoing follow-up on a secure platform in the Auratech environment.
Real cases in schools
Some of the matters we have handled as Data Protection Officer of state-funded private schools. We describe them without identifying the schools.
Enrolment across a school network in several regions
We reviewed the 2026-2027 enrolment forms of eight schools. The same errors kept appearing: schools in Catalonia referring families to the AEPD instead of the Catalan data protection authority, forms designed for public schools used in a state-funded private school, image authorisations that said different things depending on the language, and the parents’ association fee mixed up with enrolment. We corrected each document in a “what it says / what it should say” format that the school office applies in minutes.
School websites and cookies
On several websites, whoever maintained the site was switching on tools that set cookies. Instead of paying for a consent management platform for every school, we checked which cookies were really necessary, removed the rest and simplified the websites: lower cost and lower risk.
Code of conduct, digital tools and AI
We rewrote the staff code of conduct for a school network and complemented it with short policies on digital tools, artificial intelligence and the right to disconnect. Staff only sign an acknowledgement of receipt, with no commitments that would meet resistance from teachers.
Whistleblowing channel from scratch
We set up the Law 2/2023 whistleblowing channel at two schools that did not have one, with an ethics committee that includes school management and in which we act as the manager of reports. For another network, we handled the change of system manager before the regional authority.
Data that should not be there
When reviewing the record of processing activities of several schools, fingerprints appeared as processed data even though no school uses fingerprint clock-in. We removed it: a record that does not reflect reality is the first thing noticed in an inspection.
Why schools work with Auratech
- Specialised in education: more than 30 schools trust us as their Data Protection Officer.
- Experience with school networks: we work with organisations that own several schools, with common criteria adapted to each school.
- 42 five-star Google reviews from clients who work with us.
- Whistleblowing channel: University Expert qualification in Internal Reporting Systems (UNED).
The school year, month by month
Data protection in a school follows the school calendar. This is how the DPO’s work is spread across the year:
| Month | What happens |
|---|---|
| September | Enrolment, image authorisations, new staff and start-of-year training. |
| October – November | Training for teachers and review of new platforms and apps. |
| December | School events: photos and recordings by families. |
| January – March | Annual review of the record of processing activities and suppliers; preparing admissions. |
| April – June | Admissions, school trips, end of year, retention and destruction of documents. |
| All year round | Requests from families (for example, from separated parents), incidents and AEPD requirements. |
How we start
- First conversation. You tell us how the school works and what concerns you.
- Assessment and proposal. We review the situation and propose a tailored plan and quote.
- Appointment and launch. We notify the DPO appointment to the AEPD and start with what is most urgent.
Frequently asked questions
Is it mandatory for a school to have a Data Protection Officer?
Yes. Article 34.1.b) of the Spanish LOPDGDD requires schools at every level of education and universities to appoint one. In state-funded private schools, the appointment is made by the organisation that owns the school.
Can the school’s Data Protection Officer be external?
Yes. The GDPR allows the DPO to be an external professional under a service contract. It is the usual option in schools, because it avoids conflicts of interest with management and brings experience from other schools.
Is consent needed to publish photos of pupils?
Yes, for the website, social media or school publications. Under 14, consent is given by parents or guardians; from 14, by the pupil (Article 7 of the LOPDGDD).
How long does the school have to answer a family asking for its data?
One month from the request, extendable by two further months in complex cases, informing the family. The DPO makes sure the answer arrives on time and is correct.
Do you work with schools outside Madrid?
Yes. We work with schools throughout Spain, with remote follow-up and on-site meetings when needed.
Can a separated parent ask for their child’s grades?
As a general rule, yes: both parents with parental authority are entitled to their children’s academic information, unless a court order restricts it.
Can families film the school show?
For personal use, yes. Posting those images on social media is a different matter, and the school should remind families before the event.
Can someone from the school itself be the DPO?
They can, but not someone who decides on the data, such as the head or the owning organisation, because there would be a conflict of interest.
Auratech | Legal Solutions
Contact us!
Calle de las Cañas 6 (junto a Arturo Soria)
info@auratechlegal.es
911 134 963
