Is Ouriginal GDPR compliant? What universities should check now the service has ended
Ouriginal, the plagiarism checker formed from Urkund and PlagScan, was widely used at Nordic and German-speaking universities. Turnitin acquired it in 2021 and the service ended on 30 June 2026. This page sets out what is publicly documented about that change, and what a university should still do about contracts, legacy submissions and the move to Turnitin.
Short answer
Ouriginal is no longer a live service. Turnitin, which completed its acquisition of Ouriginal in November 2021, states that the Ouriginal service ended on 30 June 2026 and recommends Turnitin Similarity as the replacement. For a university, the GDPR questions are now about the past and the future: whether submissions and reports held in Ouriginal were migrated, retained or deleted, and whether the contract, records and privacy notices have been updated for Turnitin's terms. Turnitin's own DPA describes EU storage of submissions on its AWS platform, comparison processing in the US, and indefinite storage of submissions unless the institution instructs otherwise. A public statement on what happened to Ouriginal data at the end of service was not found in public documentation (checked 7 October 2026).
What is publicly documented
The old ouriginal.com domain now redirects to a Turnitin page. This summary reflects Turnitin's Ouriginal page, its Ouriginal migration guide, its press release on the acquisition and its current privacy documents, as read on 7 October 2026.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | Documented Ouriginal was "formed from the union of Urkund and PlagScan". Turnitin announced its intent to acquire Ouriginal from Procuritas on 15 March 2021 and completed the acquisition on 30 November 2021. The processor in Turnitin's current DPA is Turnitin, LLC of Oakland, California. | Turnitin press release [3], Turnitin DPA [4] |
| Service status | Documented "Ouriginal service ended on June 30, 2026." The migration guide says renewals were no longer available and the destination product is Turnitin Similarity. | Turnitin Ouriginal page [1], Migration guide [2] |
| Where data is stored and processed | Plan-dependent For Ouriginal itself: not found in public documentation (checked 7 October 2026). For Turnitin services, the DPA says the AWS platform stores all submitted content in Frankfurt with randomised, encrypted sections processed in the US; non-AWS services run from US data centres. The privacy policy says support staff may work in the UK, the EU (Netherlands, Germany, Poland, Sweden), Ukraine, the Philippines, Australia or India. | [4], Services Privacy Policy [5] |
| Data processing agreement | Plan-dependent Ouriginal's own DPA is no longer published on a reachable page. Turnitin publishes a DPA with the 2021 SCCs at Annex A, which applies to Turnitin products such as Similarity. | [4] |
| Subprocessors | Documented For Turnitin: a public list (last updated February 2026) including Amazon Web Services, Google, Microsoft (Bing), Cockroach Labs, Concentrix, SDL (machine translation), Skyflow and Zendesk, with locations given as "Global". | Turnitin Subprocessors [7] |
| International transfers (DPF, SCCs) | Documented Turnitin states that it complies with the EU-US DPF, the UK Extension and the Swiss-US DPF (status read from the vendor's privacy policy), and also uses SCCs with its group companies in the UK, India, the Netherlands, Ukraine and the US. | [5], [4], Turnitin and GDPR [6] |
| Migration and legacy data | Plan-dependent Migration ran in three stages, with a migration window of about four weeks in which institutions had access to both accounts. Pre-migration questions covered "data privacy requirements". What happened to Ouriginal archives after the end of service was not found in public documentation (checked 7 October 2026); the linked "Ouriginal Data Migration Service" document is hosted on a third-party viewer we could not read. | [2] |
| Retention and deletion | Plan-dependent Turnitin's DPA says storage of submission content "is indefinite unless instructed otherwise" and that the controller can instruct deletion at any time during or after the service period. | [4] |
What this means for a university
Validemic's analysis
Close the old processing properly. Article 28(3)(g) GDPR requires a processor, at the controller's choice, to delete or return personal data at the end of the services [8]. When a service ends through acquisition and retirement, that step is easy to miss. Years of student submissions, similarity reports and possibly a shared comparison archive may still exist somewhere. Ask Turnitin for a written account of what Ouriginal data was migrated, what was retained, and what was deleted, and keep the answer with your records.
Treat Turnitin Similarity as a new vendor assessment. The tool may feel familiar, but the processor, contract, hosting description and subprocessors are Turnitin's [4][7]. Update your record of processing activities under Article 30, your student privacy notice and your DPIA [8]. Our Turnitin page covers Turnitin's documentation in more detail.
Repository choices. Under Turnitin's DPA, submissions are kept indefinitely unless you instruct otherwise [4]. Decide deliberately whether new submissions should go into a shared repository, an institutional repository or none, and whether migrated Ouriginal material should be compared against at all.
Transfers. Turnitin describes EU storage on AWS but US processing for comparison and support access from several countries [4][5][6]. The DPF adequacy decision of 10 July 2023 covers certified US companies [9]; for the UK, Ukraine, India and the Philippines, check which transfer tool applies.
Students who have left. Former students may still have work in old archives. Access and erasure requests about Ouriginal-era submissions now have to be handled through Turnitin, so agree a route for this.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Turnitin about former Ouriginal data
- Which of our Ouriginal data (accounts, submissions, reports, archive entries) was migrated to Turnitin, and in which data centre is it stored now?
- Was any Ouriginal data not migrated? If so, has it been deleted, and can you confirm the deletion in writing with a date?
- Were our Ouriginal submissions part of a shared comparison archive, and are they still compared against other institutions' submissions?
- Which DPA governs our data today, and from what date did it replace our Ouriginal agreement?
- Which Turnitin group companies and subprocessors can access migrated submissions, and in which countries?
- Is AI writing detection part of our Turnitin licence, and is it switched on by default?
- How do you classify AI writing detection under Article 6 and Annex III of the AI Act, and will you provide Article 13 information?
- How should we handle access and erasure requests from former students about Ouriginal-era work?
The EU AI Act angle
Why it matters after the switch. Ouriginal is no longer offered, but its replacement may include AI features. Turnitin states that Similarity can, with additional licensing, help identify when AI writing tools may have been used [1]. Annex III, point 3, of the AI Act lists as high-risk AI systems intended to evaluate learning outcomes (point 3(b)) and AI systems intended for monitoring and detecting prohibited behaviour of students during tests (point 3(d)) in educational institutions [10]. Classic text matching is not AI-based in the same way, but AI writing detection used to support misconduct decisions should be assessed against these points. Article 6(3) says an Annex III system is not high-risk where it does not pose a significant risk, for example where it only performs a narrow procedural task or a preparatory task to an assessment [11]. We found no public statement from Turnitin classifying its features under the AI Act (checked 7 October 2026).
Deployer duties. If a feature is high-risk, Article 26 requires the university to use it according to the instructions for use, assign human oversight to competent staff, monitor it, keep logs under its control for at least six months, inform the students affected, and use the provider's information in its DPIA [12]. Article 27 requires a fundamental rights impact assessment before first use by bodies governed by public law, which includes many public universities [13].
Already in force. Article 5(1)(f) prohibits AI systems that infer emotions in education institutions, except for medical or safety reasons, and has applied since 2 February 2025 [14][15]. Text comparison tools do not describe doing this. The AI literacy duty in Article 4, as amended, also applies now [17].
Timeline. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 [16]. Under the amended Article 113, the high-risk rules apply to Annex III systems from 2 December 2027 [15]. Contracts signed during the Ouriginal migration will very likely still be running then.
Sources
- Ouriginal (Turnitin product page, "Ouriginal service ended on June 30, 2026"), retrieved 7 October 2026
- Ouriginal customer migration, Turnitin Guides (dated 18 July 2025), retrieved 7 October 2026
- Turnitin acquires Ouriginal, Turnitin press release, 30 November 2021, retrieved 7 October 2026
- Turnitin Data Processing Agreement, retrieved 7 October 2026
- Turnitin Services Privacy Policy (last updated 4 February 2026), retrieved 7 October 2026
- Turnitin and GDPR (FAQ), retrieved 7 October 2026
- Turnitin Subprocessors (last updated February 2026), retrieved 7 October 2026
- Regulation (EU) 2016/679 (GDPR), Articles 28, 30 and 35, text read from the Publications Office copy, retrieved 7 October 2026
- EU-US data transfers, European Commission, retrieved 7 October 2026
- AI Act Annex III, AI Act Service Desk (consolidated text of Regulation (EU) 2024/1689 as at 27 July 2026), retrieved 7 October 2026
- AI Act Article 6: Classification rules for high-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 26: Obligations of deployers of high-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 27: Fundamental rights impact assessment, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 5: Prohibited AI practices, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
- AI Act, Shaping Europe's digital future (European Commission), with link to the AI Omnibus final text (OJ L 2026/1744), retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
About this page
On 7 October 2026 we followed the ouriginal.com redirect to Turnitin's Ouriginal page and read Turnitin's Ouriginal migration guide, its 2021 acquisition press release, its DPA, services privacy policy, GDPR FAQ and subprocessor list, plus the GDPR and the consolidated AI Act text. Ouriginal's own former privacy and DPA pages are no longer reachable, so we do not describe how Ouriginal hosted data before the end of service. The official Data Privacy Framework list did not return results for automated queries that day, so DPF status is taken from Turnitin's own privacy policy. Our interpretation is labelled as Validemic's analysis. This is not legal advice and does not say whether any particular use of Ouriginal or Turnitin complies with the GDPR or the AI Act. If you see an error or an outdated detail, please contact us and we will correct it.
Frequently asked questions
Is Ouriginal still available?
No. Turnitin's Ouriginal page states that the Ouriginal service ended on 30 June 2026, and its migration guide says renewals of Ouriginal licences were no longer available. Turnitin points former customers to Turnitin Similarity.
Is Ouriginal the same company as Urkund?
Turnitin describes Ouriginal as a company formed from the union of Urkund and PlagScan. Turnitin completed its acquisition of Ouriginal from the Nordic private equity firm Procuritas on 30 November 2021, after announcing its intent on 15 March 2021.
What happens to student papers that were submitted to Ouriginal?
We did not find a public statement on what happens to Ouriginal submissions and archives after the end of service (checked 7 October 2026). Turnitin's migration guide says data privacy requirements are covered in the pre-migration questions. Universities should ask Turnitin in writing whether their Ouriginal data was migrated, retained or deleted, and ask for confirmation of deletion where applicable.
Is moving from Ouriginal to Turnitin Similarity just a product upgrade?
From a data protection point of view it is a change of processor terms. Turnitin's DPA names Turnitin, LLC in the US as processor, describes EU storage on its AWS platform with encrypted fragments processed in the US for comparison, and states that submissions are stored indefinitely unless the institution instructs otherwise. Records of processing, privacy notices and the DPIA should be updated.
Does the EU AI Act matter for Ouriginal?
Ouriginal itself is no longer offered. The AI Act matters for the replacement: Annex III lists AI systems used to evaluate learning outcomes or to detect prohibited behaviour of students during tests as high-risk, with deployer obligations from 2 December 2027. Turnitin Similarity can be licensed with AI writing detection, which needs its own assessment.