Google Workspace for Education GDPR compliance just became a live issue for every school in Spain, even if yours is not the one that got fined. Decision PS-00607-2025 of the Spanish Data Protection Authority (AEPD) is the first monetary fine against a school over this platform: 20,000 euros, reduced to 12,000 after the school admitted liability and paid. However, the figure is not the point. The point is the criterion the regulator has now fixed for every school. Here is what happened and how the fine was calculated. And also, what the AEPD now expects and what your school should check this week.
In this article we will discuss...
What happened: the case in five facts
The sanctioned school is a private school in Madrid. These are the facts the AEPD treats as proven:
- It used the free edition of Google Workspace for Education (Fundamentals) from the 2021-2022 academic year.
- It served 531 pupils, 395 of them under 14, through accounts created by the school and school-owned Chromebooks.
- The active services were the usual ones: Classroom, Drive, Gmail, Calendar and Docs.
- It all started with a complaint from a mother in April 2024. Her children, primary pupils, could reach YouTube and video games from the school laptop.
- Moreover, the family had received no proper information about what the platform did with their children’s data.
In other words, exactly the scenario of most schools that have gone digital. That is why the decision is worth reading as if it were about your own school.
What happened next: three Google Workspace for Education GDPR infringements
The AEPD found three GDPR infringements and priced each one separately:
- Insufficient legal basis (Article 6.1 GDPR): 10,000 euros.
- Lack of transparency towards families (Article 5.1.a GDPR): 6,000 euros.
- A deficient data protection impact assessment (Article 35 GDPR): 4,000 euros.
The school admitted liability and paid early. Therefore, it obtained the two 20 % reductions provided by Article 85 of Spain’s Administrative Procedure Act (Law 39/2015). The final fine came to 12,000 euros, paid in January 2026. That saving has a price of its own: the decision is final and no court will ever review it. Put simply, the criterion stays alive for the next school.
Why the liability falls on the school, not on Google
The AEPD has been warning for a while. In 2024 its Legal Office advised against the agreement between INTEF (the Ministry’s teacher-training institute) and Google for the classrooms of Ceuta and Melilla (Report 0050/2023). It had also cautioned at least one regional education authority for deploying the tool without a risk analysis. What is new now is that the fine lands, for the first time, on a specific school.
The explanation is simple. Google formally acts as a data processor. However, its terms provide for processing that serves Google’s own interests, such as improving or personalising the service. According to the regulator, the school “allows and tolerates” those purposes by choosing the tool. That is why whoever picks the platform answers for what the platform does, and “Google does that, not us” is not a defence.
Three Google Workspace for Education GDPR mistakes your school may be making
1. Assuming the Education Act covers everything
The 23rd additional provision of Spain’s Education Act (LOE) lets schools process pupil data that is “necessary for the exercise of their educational function”. That legal basis exists, but it is narrower than it looks. The AEPD draws a line between what is necessary to educate and what is merely convenient from a technological point of view. Managing assignments in Classroom fits. In contrast, letting the platform collect usage habits, IP addresses or viewed content for its own purposes does not. And for that, the school had no other legal basis.
2. Informing families halfway, with no proof
The school did inform: it drafted a privacy policy for parents and held a meeting. However, it said it processed name, surname, password and year group, and left out the rest: usage data linked to each pupil’s profile, device information, cookies and international transfers. Moreover, it could not prove that the information had reached every family, because the platform kept no record of delivery. Its record of processing activities had the same gaps. Complying is not enough; you must be able to prove it.
3. A paper impact assessment
The school had carried out a DPIA before deploying the tool and, even so, it cost 4,000 euros. Why? It rested on a false premise (only identification data is processed), it did not analyse international transfers or proportionality, and the improvements the DPIA itself recommended were never implemented. That is why a DPIA that is not revisited when the processing changes is a document, not a safeguard.
Google Workspace for Education GDPR: two details almost nobody is reporting
The first affects every faith school. The AEPD held that the pupils’ email domain, which included the school’s name as a Catholic school, indirectly revealed their religious beliefs. In other words, a plain “@nameofschool” account can turn identification data into special-category data (Article 9 GDPR), with everything that entails.
The second is consent. Many schools believe the fix is to ask parents to sign an authorisation. It is not that simple. The educational function does not require consent. And for anything beyond it, consent in a school setting is of doubtful validity because of the power imbalance between family and school, as Report 0050/2023 already warned. Therefore, the way out is not more paperwork but less data: configuring the platform so that it only does what the educational function needs.
What data Google Workspace for Education generates in a school
Much of the problem is that schools only see the tip of the iceberg. When a pupil uses the platform, at least these categories are processed:
- Identification and access: name, surname, email address, password, year and class group.
- Content: assignments, documents, comments, emails and calendar entries the pupil creates or receives.
- Usage and habits: which apps they open, when, for how long and what content they view.
- Technical: IP address, cookies, identifiers and device characteristics.
- Inferred: age from the organisational unit and, as we saw, religion from the email domain.
Geography adds another layer. Google relies on the EU-US Data Privacy Framework and on standard contractual clauses for international transfers. Furthermore, the free edition does not let you choose the region where data is stored. Your DPIA has to state and assess this, not assume it.
Your Google Workspace for Education GDPR checklist for this week
- Real inventory. Open the admin console and note which Google services are enabled for pupils, both core and additional, and what data each one generates. What is missing from the inventory cannot appear in the DPIA or in the information given to families.
- Configuration by age. Split pupils into organisational units by stage. Then disable the additional services you do not use for them (YouTube included) or, if you need them, switch on restricted mode. Review Chromebook policies too: browsing, extensions and permitted apps.
- Service Data Addendum. Check whether your super administrator has accepted the addendum Google offers for the Education editions. With it, Google processes service data as a processor, except for a residual processing it still carries out as a controller. It does not solve everything, but it narrows exactly the part the AEPD has pointed at.
- Legal basis per purpose. Separate what is necessary to educate (LOE) from what is not, and remove the latter through configuration. Whatever you cannot remove needs its own legal basis and must appear in your records.
- A living DPIA. Redo the assessment against the real processing: complete data categories, international transfers, necessity and proportionality of each service. Above all, implement the measures it proposes and record when you did.
- Contract and records. Keep the Google terms you accepted, with date and version, and update your record of processing activities with every data category and recipient.
How to inform families and keep proof
The AEPD did not sanction the school for not informing, but for informing halfway and being unable to prove it. Therefore, the information given to families must include, at a minimum, the actual apps in use, the data each one generates (including usage and technical data), the purposes, the legal basis, international transfers and their safeguards, retention periods and how to exercise rights.
The second requirement is proof. A communication platform with read receipts, a signature in the enrolment pack or an email with confirmation will do, but it has to be individual and archived. A parents’ meeting with no minutes and a policy on the website do not prove that each family was informed. That was, precisely, one of the sanctioned school’s failures.
Frequently asked questions about Google Workspace for Education GDPR compliance
Is it illegal for a school to use Google Workspace for Education?
No. The AEPD does not ban the tool. It sanctions using it without a legal basis for everything it does, without complete information and without a real DPIA. In fact, the decision itself gives the school two ways out: legitimise the processing or stop it.
Do we need parental consent?
For the educational function, no: the legal basis is the Education Act. For processing that goes beyond it, consent is a weak basis in a school setting. That is why the sensible route is to configure the platform so that such processing does not happen.
Does this affect Google Classroom and Chromebooks?
Yes. Classroom is one of the core services examined. In addition, school Chromebooks generate device and usage data that must appear in the information given to families and in the DPIA.
Does it apply to state schools too?
The criterion is the same, but the controller may differ. In state education the controller is usually the regional education authority, sometimes under a regional agreement with Google. In contrast, in private and international schools the controller is the school itself, and it is the school that signs the terms.
What if my school uses Microsoft 365 or another platform?
The reasoning is identical: whoever chooses the tool answers for what it does with the data. The settings and contracts change, the obligation does not. We analysed Microsoft 365 in schools with the same approach.
Conclusion: the fine does not punish going digital, it punishes not governing it
The sanction does not punish digital classrooms; it punishes going digital without governing the processing. Google Workspace for Education GDPR work is now governance work: knowing what the tool does, limiting it to education, explaining it properly to families and keeping proof of everything. An external DPO for schools does exactly that: reviews the configuration, redoes the DPIA and the family information, and stands beside the school before the AEPD if a complaint arrives. If you already have doubts about your own setup, let’s talk. And if classroom technology interests you, we have also looked at frequency detectors in exams.
This article provides general information and does not replace legal advice on a specific case.