Is itslearning GDPR compliant? What universities should check
itslearning is a learning platform from Bergen, Norway, used by schools and some higher education institutions across Europe. Since 2019 it has been part of the Finnish learning group Sanoma. This page sets out what itslearning publicly documents about where data is processed, its data processor agreement, subprocessors and its AI toolkit, and what that means for a university.
Short answer
itslearning AS in Bergen, a Sanoma company, says it acts as a data processor for institutions and that it never processes users' personal data outside the EU/EEA. Its subprocessor list names AWS in Germany, Ireland and Sweden and Cloudflare in the EU, with Sanoma and itslearning group companies providing support from European countries. A data processor agreement is published, and itslearning states ISO 27001 and ISO 27701 certification. Its AI toolkit for teachers runs on Azure OpenAI in Sweden and, according to itslearning, does not store or train on generated content. Gaps are mainly about currency: the public subprocessor list is dated October 2022 and the public DPA October 2020.
What itslearning documents publicly
The table summarises itslearning's privacy commitment pages, user privacy information, subprocessor list, public data processor agreement and AI toolkit page, plus the 2019 sale announcement, all read on 7 October 2026.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and ownership | Documented itslearning AS, Bergen, Norway, founded in 1999. EQT announced the sale of itslearning to Sanoma on 5 December 2019. itslearning describes itself as "a Sanoma company". | EQT announcement [1], User privacy information [2] |
| Role | Documented For its cloud platform itslearning is "a data processor" and does "not decide the purpose or lawfulness" of processing; the institution controls user data. | [2], Privacy commitment [3] |
| Where data is processed | Documented "We never process our users' personal data outside the EU/EEA." Hosting is on Amazon AWS in Germany, Ireland and Sweden; Cloudflare in the EU provides network security. | [2], Sub-processors [4] |
| Subprocessors | Partly documented Mandatory: AWS and Cloudflare. Optional with opt-out: Microsoft (Ireland), Lunaweb (Germany) and Ziggeo (Germany, video). Opt-in: SDUI (Germany) for BigBlueButton or Collabora. itslearning and Sanoma group entities in Norway, Germany, France, the Netherlands, Sweden, Denmark, the UK, Finland, Spain, Poland and Belgium provide support. The list is marked as last updated in October 2022 and says some customers' DPAs may name other subprocessors. | [4] |
| Data processor agreement | Documented A public DPA (October 2020 version) names a data protection officer at Sanoma Media Finland Oy. It bars transfers outside the EU/EEA or pre-approved third countries without the controller's prior written consent, requires breach notice within 72 hours of awareness, and provides for regular security audits. | Data Processor Agreement (PDF) [5] |
| Retention and deletion | Documented The DPA says all customer data, including backups, is permanently deleted within six months of the end of the agreement. | [5] |
| Security certifications | Documented itslearning states that it is ISO 27001 certified and also certified to ISO 27701 for privacy information management, and links both certificates. They are issued by TÜV NORD Nederland to itslearning AS, cover development, operations and support of its LMS (ISO 27701: in its role as PII processor), and are valid until 19 June 2027 and 19 July 2027 respectively. | [3], ISO 27001 certificate (PDF) [11], ISO 27701 certificate (PDF) [12] |
| AI toolkit | Documented The toolkit generates tests, assignments, worksheets and rubrics for teachers. It is "Powered by Azure OpenAI, hosted in Sweden", uses GPT-5.4 mini, and content is "processed in real time to produce a response, then discarded" and not used to train AI models. It is only available to teacher accounts, and system administrators decide which teachers and schools have access. itslearning describes it as aligned with the EU AI Act. | AI toolkit [6] |
| AI provider in subprocessor list | Not found The public subprocessor list, dated October 2022, does not name Azure OpenAI or another AI provider. How the AI provider is contracted (for example under the existing Microsoft entry) was not found in public documentation (checked 7 October 2026). | [4] |
| Learning analytics | Not found Public privacy documentation describing analytics or prediction features was not found (checked 7 October 2026). | [2], [3] |
What this means for a university
Validemic's analysis
A European processor with a European footprint. itslearning is one of the few LMS providers whose public documentation commits to processing within the EU/EEA [2] and whose listed hosting, network and support providers are all in Europe [4]. For a university that wants to avoid third-country transfers for its learning platform, that is a significant strength. Norway is in the EEA, so the Norwegian parent is not a third-country recipient.
Public terms, but check for newer versions. Publishing the DPA and a six-month deletion commitment [5] makes due diligence straightforward. The public versions are dated 2020 and 2022, while the AI toolkit page describes a model and a pilot from 2026 [6]. A university should ask for the current DPA and subprocessor list and confirm how the Azure OpenAI service is covered.
Breach timing. The 2020 DPA allows up to 72 hours for itslearning to report a breach [5]. Article 33 GDPR requires the processor to notify the controller without undue delay and gives the controller 72 hours from its own awareness to notify the authority [7]. A shorter contractual period, for example 24 or 48 hours, leaves the university room to assess and report.
AI design choices help. A teacher-only toolkit, EU hosting, administrator control over which teachers have access, and no storage of generated content [6] reduce the data protection footprint of AI considerably. Teachers can still paste student work into a prompt, so local guidance on what not to enter remains useful.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask itslearning before approving or renewing
- Can we receive the current data processor agreement and subprocessor list, and how will we be notified of changes?
- Which AWS region holds our instance and backups: Germany, Ireland or Sweden?
- How is Azure OpenAI contracted for the AI toolkit, which Microsoft entity and region, and what retention applies, including any abuse monitoring?
- Is the AI toolkit enabled for any teachers in our instance today, and who decides when access is extended?
- Which Sanoma group companies can access our data, and for which support tasks?
- Can the breach notification period be shortened to 24 or 48 hours?
- Which third-party extensions and LTI tools in our instance receive student data, and are they our processors or itslearning's?
- Can we receive the statements of applicability and recent audit summaries for the ISO 27001 and ISO 27701 certificates?
The EU AI Act angle
Annex III point 3 lists AI systems intended to evaluate learning outcomes, including when those outcomes steer the learning process, as high-risk [8]. itslearning's AI toolkit, as described publicly, creates teaching material such as tests, assignments and rubrics for teachers and has no student-facing tutor [6]. Generating a test is not the same as evaluating a student's answers, so the toolkit as described looks like general assistance rather than an Annex III use; a university should revisit that view if itslearning adds features that mark or rate student work. Annex III obligations apply from 2 December 2027 under the amended Article 113 [9]. The obligation in force now is Article 4: deployers must take measures to support the AI literacy of staff who use AI on their behalf [10].
Sources
- EQT sells itslearning to Sanoma, EQT, 5 December 2019, retrieved 7 October 2026
- User privacy information, itslearning, retrieved 7 October 2026
- Privacy commitment, itslearning, retrieved 7 October 2026
- Sub-processors (last updated October 2022), itslearning, retrieved 7 October 2026
- Data Processor Agreement, October 2020 version (PDF), itslearning, retrieved 7 October 2026
- itslearning AI toolkit, retrieved 7 October 2026
- Regulation (EU) 2016/679 (GDPR), Article 33, text read from the Publications Office copy, retrieved 7 October 2026
- AI Act Annex III, AI Act Service Desk (consolidated text of Regulation (EU) 2024/1689), retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
- ISO/IEC 27001:2022 certificate, itslearning AS (PDF), TÜV NORD Nederland, retrieved 7 October 2026
- ISO/IEC 27701:2019 certificate, itslearning AS (PDF), TÜV NORD Nederland, retrieved 7 October 2026
About this page
We read itslearning's privacy commitment and user privacy pages, its subprocessor list, the public data processor agreement, its ISO certificates, the AI toolkit page, EQT's 2019 announcement, the GDPR and the relevant AI Act texts on 7 October 2026. Where itslearning's public documents are silent or dated, we say so. Our own interpretation is labelled as Validemic's analysis. This page is not legal advice and does not say whether any particular use of itslearning complies with the GDPR. If you spot an error or itslearning has updated a document, please contact us and we will correct it.
Frequently asked questions
Is itslearning GDPR compliant?
No tool is GDPR compliant on its own. itslearning says it acts as a data processor for its cloud platform, publishes a data processor agreement and states that it never processes users' personal data outside the EU/EEA. Whether a university's use complies depends on its contract, configuration, retention rules and how it informs students and staff.
Where is itslearning data stored?
itslearning's subprocessor list names Amazon AWS in Germany, Ireland and Sweden for hosting and Cloudflare in the EU for network security. Its user privacy page says it never processes users' personal data outside the EU/EEA.
Does the itslearning AI toolkit send student data to OpenAI?
itslearning says the AI toolkit runs on Azure OpenAI hosted in Sweden, using a GPT-5.4 mini model, that generated content is not stored or used to train AI models, and that the toolkit is designed for teachers rather than students.
Who owns itslearning?
Sanoma, the Finnish media and learning company, acquired itslearning from EQT in a deal announced on 5 December 2019. itslearning's DPA names a data protection officer at Sanoma Media Finland Oy, and Sanoma group companies appear in its list of support providers.
How quickly must itslearning report a data breach?
The public 2020 version of the itslearning data processor agreement says breaches should be reported without undue delay and no later than 72 hours after itslearning becomes aware. Universities may want a shorter period, because the controller's own 72-hour deadline under Article 33 GDPR runs from when it becomes aware.