Is Blackboard GDPR compliant? What universities should check
Blackboard Learn, now marketed as Blackboard LMS, is used by universities across Europe for courses, submissions, grading and communication. Its owner Anthology emerged from US Chapter 11 restructuring in 2026 and renamed itself Blackboard. This page sets out what the company publicly documents about hosting, transfers, subprocessors and its generative AI features, and what that means for a university.
Short answer
Blackboard T&L, LLC is a US company. It says it acts as a processor for institutions, participates in the EU-US Data Privacy Framework and the UK Extension, and uses the 2021 standard contractual clauses within its group. Its trust centre says many products are regionally hosted but does not name EU regions, and says support staff may access data from support locations such as the US, Colombia, India, the Netherlands and Australia. Blackboard LMS holds ISO 27001, 27017, 27018 and 27701 certificates. Its generative AI features are marked opt-in, and most of those in Blackboard LMS run on Azure OpenAI, with a primary instance in the United States. A university should check the hosting region in its contract and decide feature by feature whether to enable AI.
Who you contract with in 2026
Anthology, the previous owner of Blackboard, completed a Chapter 11 restructuring and on 2 March 2026 announced that it had rebranded as Blackboard and would operate its teaching and learning business (Blackboard LMS, Ally, Illuminate, Evaluate and Institutional Effectiveness) on a stand-alone basis, after selling other businesses to Ellucian and Encoura [1]. The privacy statement, last updated on 29 May 2026, names Blackboard T&L, LLC and its affiliates [2]. Universities with older contracts should check which entity is now their processor and whether any student success or enterprise products they use moved to a different company.
What Blackboard documents publicly
The table summarises Blackboard's privacy statement, trust centre pages, DPF statement, subprocessor list, AI documentation and transparency notes, all read on 7 October 2026. A current data processing addendum was not found as a public document (checked 7 October 2026); the subprocessor page refers to one.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and role | Documented Blackboard T&L, LLC, Washington DC. When it provides services to institutions, "we are considered a processor" and the institution's privacy statement applies. A Global Privacy Officer is reachable at privacy@blackboard.com. | Privacy Statement [2] |
| Where data is stored | Partly documented "Many Blackboard products are regionally hosted." The trust centre does not name regions or say how a client selects one. Generative AI functions "may be provided from data centers outside of our clients' usual hosting location". | Hosting and data transfers [3] |
| Support access | Documented Support staff may access data from support locations such as the US, Colombia, India, the Netherlands and Australia for 24/7 coverage. | [3] |
| International transfers (DPF, SCCs) | Documented Blackboard T&L, LLC and Blackboard, LLC state that they participate in the EU-US DPF and the UK Extension (statement updated 29 September 2026; the Swiss-US framework is not mentioned). Intra-group transfers use the 2021 processor-to-processor SCCs. DPF status is read from the vendor's statement; the official DPF list API returned errors on the check date. | DPF Statement [4], [3] |
| Subprocessors | Documented A public list (updated 27 February 2026) includes AWS (hosting), Microsoft Azure (Office 365, security and AI functions), Cloudflare, New Relic, NetApp and WeLocalize, all listed with US locations. Clients can follow the page for email updates. | Sub-processors [5] |
| Generative AI features | Documented The list (updated 4 May 2026) includes AI Design Assistant, AVA Assisted Feedback, AVA Responses to Student Messages, AI Conversation, AVA Playground (AWS Bedrock), AI Alt Text Assistant (AWS Bedrock) and Illuminate Data Q&A (Amazon Q). All are marked opt-in. | Generative AI features [6] |
| AI processing location and training | Documented The primary Azure OpenAI instance "is hosted in the United States", with resources at times in Canada, the UK or France. Microsoft contractually commits not to use inputs or outputs to train its models, and Blackboard does not fine-tune with client data. AVA Playground and AI Alt Text Assistant use AWS Bedrock instead. | AI Design Assistant [7], [11], [6] |
| AI governance | Documented A Trustworthy AI programme aligned to the NIST AI Risk Management Framework, with an AI system inventory and product reviews. Blackboard lists an EU AI Pact pledge in its compliance overview. | Trustworthy AI [8], Compliance [9] |
| Security certifications | Documented ISO 27001, 27017, 27018 and 27701 for Blackboard LMS, SafeAssign, Ally, Illuminate and Outcomes; SOC 2 for several products; a HECVAT. | [9] |
| Retention and deletion | Not found The privacy statement says data is kept as long as necessary. Contractual deletion of institutional LMS data at the end of a subscription was not found in public documentation (checked 7 October 2026). | [2] |
What this means for a university
Validemic's analysis
Strong certification and transparency material. The ISO 27701 privacy certificate [9], a public subprocessor list with a follow function [5], and per-feature transparency notes for AI are more than many LMS vendors publish. They make a DPIA easier to write.
Hosting is stated in general terms. "Regionally hosted" [3] is not a commitment. The EU region for your instance, backups and analytics exports should be written into the contract. Support access from locations on several continents [3] is a transfer that belongs in the transfer impact assessment, even where the DPF covers the US entities [4].
AI processing follows a different map. Enabling an AI feature can send course content, and for some features student messages or instructor feedback, to Azure OpenAI, whose primary instance is in the US [7][11]. An EU-hosted Blackboard site does not mean EU-only AI processing. The opt-in design [6] lets a university hold features back until the assessment is done, which is a real strength.
Learning analytics deserves its own entry. Illuminate is covered by the same ISO certificates as the LMS [9], and its Data Q&A feature answers analytics questions through Amazon Q on an opt-in basis [6]. Analytics on student activity and grades is a separate purpose from running courses, so it needs its own legal basis, transparency text for students and retention rule, even when the data never leaves the platform.
Corporate change is a contract question. After the 2026 restructuring and divestitures [1], universities should confirm that their DPA, subprocessor notices and breach contacts follow the right entity, and that no data moved with a divested product.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Blackboard before approving or renewing
- Which Blackboard entity is our processor after the 2026 restructuring, and which DPA version applies?
- Which named AWS region holds our Blackboard LMS data, backups and Illuminate data, and is it in our contract?
- Which support locations accessed our data in the last year, and under which transfer mechanism for non-US locations such as Colombia and India?
- For each AI feature we enable, which data categories are sent, to which Azure OpenAI region, and what retention applies at Microsoft?
- Can AVA and AI Conversation be restricted to EU processing, and if not, can we keep them off?
- How long is institutional data kept after the end of our subscription, and how is deletion confirmed?
- Which LTI tools and partner integrations receive student data, and whose subprocessors are they?
The EU AI Act angle
Annex III point 3 covers AI systems intended to evaluate learning outcomes, including when they steer the learning process [10]. AVA Assisted Feedback can summarise instructor feedback into overall feedback based on rubric criteria, and Blackboard says the feature involves no automated decision-making with a legal or otherwise significant effect on learners, and that instructors are asked to review output and can edit it [11]. Article 6(3) excludes systems that only improve a completed human activity or perform a preparatory task, unless they profile people [12]. Whether a given feature stays outside Annex III depends on how it is configured and used, so a university should document its classification for each feature it enables. Blackboard's transparency notes do not state a classification. Annex III obligations apply from 2 December 2027 under the amended Article 113 [13]. Article 4, in force now, requires deployers to take measures to support the AI literacy of staff using these tools [14].
Sources
- Blackboard (formerly Anthology) emerges debt-free and focused, Blackboard, 2 March 2026, retrieved 7 October 2026
- Blackboard Privacy Statement (last updated 29 May 2026), retrieved 7 October 2026
- Hosting and data transfers, Blackboard Trust Center, retrieved 7 October 2026
- Data Privacy Framework Statement (updated 29 September 2026), retrieved 7 October 2026
- Sub-processors (updated 27 February 2026), retrieved 7 October 2026
- List of generative AI features (updated 4 May 2026), retrieved 7 October 2026
- Blackboard AI Design Assistant, administrator help, retrieved 7 October 2026
- Trustworthy AI approach, Blackboard Trust Center, retrieved 7 October 2026
- Compliance, Blackboard Trust Center, retrieved 7 October 2026
- AI Act Annex III, AI Act Service Desk (consolidated text of Regulation (EU) 2024/1689), retrieved 7 October 2026
- AVA Assisted Feedback transparency note, retrieved 7 October 2026
- AI Act Article 6: Classification rules for high-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
About this page
We read Blackboard's March 2026 announcement, privacy statement, trust centre pages on hosting, compliance, subprocessors, the DPF and trustworthy AI, its list of generative AI features, the AI Design Assistant help page, the AVA Assisted Feedback transparency note and the relevant AI Act texts on 7 October 2026. Where Blackboard's public documents are silent, we say so. Our own interpretation is labelled as Validemic's analysis. This page is not legal advice and does not say whether any particular use of Blackboard complies with the GDPR. If you spot an error or Blackboard has updated a document, please contact us and we will correct it.
Frequently asked questions
Is Blackboard GDPR compliant?
No tool is GDPR compliant on its own. Blackboard says it acts as a processor when it provides services to institutions, states that it participates in the EU-US Data Privacy Framework and uses standard contractual clauses for transfers. Whether a university's use complies depends on its contract, configuration and how it informs students and staff.
Is Anthology still the company behind Blackboard?
Anthology completed a Chapter 11 restructuring and announced on 2 March 2026 that it had rebranded as Blackboard, keeping the teaching and learning products such as Blackboard LMS, Ally and Illuminate and selling other businesses to Ellucian and Encoura. The privacy statement now names Blackboard T&L, LLC.
Where are Blackboard's AI features processed?
Blackboard's documentation says AI Design Assistant, AI Conversation, AVA Assisted Feedback and AVA Responses to Student Messages use Microsoft's Azure OpenAI Service, and its transparency material describes a primary instance in the United States and at times resources in Canada, the United Kingdom or France. That is relevant even for universities whose LMS data is hosted in the EU.
Does Blackboard use student data to train AI?
Blackboard says Microsoft contractually commits not to use inputs to or outputs of Azure OpenAI to train or retrain its models, and that Blackboard does not fine-tune the service with client data. All generative AI features on its published list are marked opt-in.
Who can access Blackboard data for support?
Blackboard's trust centre says support staff may access data from support locations such as the US, Colombia, India, the Netherlands and Australia to provide round-the-clock coverage. A university should include that access in its transfer assessment.