GDPR for universities: the complete guide for higher education (2026)

A source-backed overview of data protection in higher education for data protection officers, IT and library staff: what the GDPR requires of a university, how other European universities apply it, what supervisory authorities have fined universities and schools for, and a 12-month plan to put it into practice. Each section links to a deeper guide.

Published 9 October 2026 · Sources checked 9 October 2026

Also available in: Svenska · Nederlands · Norsk · Suomi · Dansk · Français · Español · Português

1. What does the GDPR mean for a university?

The GDPR applies to every university in the EU and EEA, public or private, because every university processes personal data about students, applicants, staff, research participants, alumni, library users and visitors. A public university is usually a public authority, which changes three things: the legal bases it can use, its duty to appoint a DPO, and, in some countries, whether it can be fined.

Higher education is a hard environment for data protection. A university is at the same time an employer, a teaching institution, an examining authority, a research organisation, a library, a landlord and sometimes a healthcare partner. Faculties and research groups often choose their own tools. Thousands of new students arrive every year, and many staff work across institutions and countries. The GDPR does not have special rules for universities, but it leaves room for national law, and national university and archive laws shape a large part of daily practice.

This guide covers the whole landscape at overview depth. For the text of the regulation itself, see our GDPR explained page. For each topic below, we link to a deeper guide, template or free tool.

2. Which legal basis does a university use?

Most European public universities rely on Article 6(1)(e) GDPR: processing necessary for a task carried out in the public interest or in the exercise of official authority. Article 6(3) requires that basis to be laid down by Union or Member State law, so the university points to the national law that gives it its tasks, such as a universities act. Legal obligation (Art. 6(1)(c)) covers statutory duties.

Public task, anchored in national law

Article 6(3) says the basis for processing under points (c) and (e) "shall be laid down by" Union law or Member State law to which the controller is subject. University privacy notices show how this works in practice:

• The University of Oslo bases student data processing on Article 6(1)(e) together with sections 2-1 and 2-8 of the Norwegian Universities and University Colleges Act.
• The University of Helsinki states that processing "is based on the University's statutory tasks carried out in the public interest (section 2 of the Universities Act)".
• Stockholm University says the most common legal basis is "a task of public interest in accordance with Article 6(1)(e)".
• Uppsala University notes that processing "is often an aspect of the exercise of official authority" in student matters, and often occurs in the public interest in research.
• Trinity College Dublin grounds research on Article 6(1)(e) and the Irish Universities Act 1997, under which promoting research is "a primary object and function of the University".
• The University of Barcelona uses public interest for student mobility data, citing the Spanish Organic Law 2/2023 on the university system (LOSU) and the Catalan universities law.

A single notice can use several bases. Université Paris-Saclay's applicant privacy notice (September 2026) lists the public-interest mission for handling applications, a legal obligation for enrolment, and legitimate interest for invitations to graduation events. This purpose-by-purpose approach is good practice and makes your record of processing easier to keep.

The limit on legitimate interest

The last subparagraph of Article 6(1) says that point (f), legitimate interest, "shall not apply to processing carried out by public authorities in the performance of their tasks". Recital 47 explains that it is for the legislator to provide the legal basis for public authorities by law. The EDPB's Guidelines 1/2024 on legitimate interest (version 1.0, published for consultation) add that public authorities may rely on it only "in exceptional and limited cases" for activities that are not linked to their specific tasks, where national law permits, and that this reliance should be documented internally.

Validemic's analysis In practice this means a public university should not reach for legitimate interest for teaching, assessment, student administration or research. It may be arguable for genuinely peripheral activities, such as some alumni events or a campus shop, depending on national law. If you use it, carry out and keep a balancing test; our legitimate interest assessment template is built for this.

Why consent is a weak basis for core processing

Recital 43 says consent should not be a valid legal ground where there is "a clear imbalance between the data subject and the controller, in particular where the controller is a public authority". The University of Oslo's staff guidance applies this to employment, noting that the university as an employer "would normally not be able to use consent as a processing basis for employees". The same logic applies to students who must use a system to pass a course. Consent still has a place for optional activities: newsletters, photographs used in marketing, or an optional pilot tool. The EDPB's consent guidelines set out the conditions. For research, the choice of legal basis is covered in our guide legal basis for research under the GDPR.

3. Whose data does a university process?

A university processes data about at least seven groups of people. Each group has different purposes, legal bases, retention periods and risks, so it is useful to organise privacy notices, records and retention schedules by group. The table gives a typical starting point, not a rule: check your own national law.

4. Special category and criminal offence data

Article 9(1) prohibits processing of special category data unless an exception in Article 9(2) applies. The categories are racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health data, and data about sex life or sexual orientation. Universities process all of these.

Common university examples:

• Health data for study adjustments, exam accommodations, sick leave and occupational health.
• Biometric data in some proctoring tools, facial recognition and access control.
• Trade union membership in payroll deductions.
• Research data in medicine, psychology, social science and political science, where special categories are often the subject of the research.

For core university tasks, the most common exceptions are Article 9(2)(b) (employment law), 9(2)(g) (substantial public interest on the basis of law) and 9(2)(j) (research, with Article 89 safeguards). The University of Oslo states that for special categories of student data "the legal basis is Article 9 g) of the GDPR", read together with its national act. Each of these exceptions depends on Union or national law, so the exact route differs by country.

Criminal convictions and offences are covered separately by Article 10, which allows processing only under official authority or where Union or Member State law authorises it. This matters for criminal record checks for students in teacher training, healthcare and social work programmes, which are usually based on national law.

5. Does a university need a DPO?

Yes, if it is a public authority or body. Article 37(1)(a) requires a DPO where "the processing is carried out by a public authority or body, except for courts". Private universities usually need one too, because large-scale processing of special category data or regular and systematic monitoring of people is common in higher education (Art. 37(1)(b) and (c)).

The Faculty of Law of the University of Lisbon gives a typical example: its privacy policy says that, "Atendendo à obrigação legal que resulta da alínea a) do n.º 1 do artigo 37.º do RGPD" (given the legal obligation under Article 37(1)(a) GDPR), it has designated a DPO. Article 37(3) allows a single DPO for several public bodies, taking account of their structure and size, which some smaller institutions use.

What the DPO does, and does not do

Under Article 39(1) the DPO must, at least, inform and advise the university and its staff, monitor compliance (including the assignment of responsibilities, awareness-raising, training and audits), advise on DPIAs, and cooperate with and act as the contact point for the supervisory authority. Utrecht University sums it up: "The DPO's main job is to oversee the application and observance of the GDPR within the organisation."

The DPO advises; the university decides. Article 38 protects the role: the DPO must be involved "properly and in a timely manner" in all data protection issues, must be given the resources needed, "shall not be dismissed or penalised" for performing the tasks, and reports directly to the highest management level. Contact details must be published and communicated to the supervisory authority (Art. 37(7)). Most universities publish a functional mailbox, such as fg@uva.nl at the University of Amsterdam or dataskyddsombud@uu.se at Uppsala.

The Article 29 Working Party's DPO guidelines (WP243 rev.01), endorsed by the EDPB, say the DPO cannot hold a position that leads them to determine purposes and means, and give the head of IT and the head of HR as examples of roles that may conflict. In the EDPB's 2023 coordinated enforcement action on DPOs, 25 authorities found, among other things, DPOs with insufficient resources and DPOs not given all the tasks the GDPR requires.

Validemic's analysis In a large university one DPO cannot review every tool, notice and project. The institutions that cope best build a network: data protection contacts in each faculty, a privacy specialist in the research office, and IT security handling the technical review. The DPO then advises on the hard cases and monitors the system.

6. Records of processing (Article 30)

Every university must keep a record of processing activities (ROPA). The exemption in Article 30(5) for organisations with fewer than 250 employees does not help: it does not apply where processing is "not occasional" or includes special category data, which covers any university. The record must list purposes, categories of data and data subjects, recipients, transfers, retention and security measures.

The record is also a working tool. KU Leuven tells students that "specific retention periods per processing activity are included in the register of processing activities", which links the record directly to the retention schedule. The Universidad Complutense de Madrid publishes its Registro de Actividades de Tratamiento online, so anyone can see what the university processes and why.

A practical structure is one entry per purpose, grouped by data subject group, with a column for each system and vendor involved. Our ROPA template for universities and the Word template follow this structure.

7. Transparency and privacy notices

Articles 13 and 14 require the university to tell people, at the time data is collected (or within a month if it comes from elsewhere), who the controller is, how to reach the DPO, the purposes and legal basis, recipients, transfers, retention and their rights. Universities usually publish layered notices: a general notice, then one per group or major process.

Examples worth looking at:

• University of Amsterdam names the controller clearly: "The Executive Board of the UvA is the controller".
• KU Leuven has a separate notice for research participants, alongside its student notice.
• Université Paris-Saclay publishes a notice for one specific process (online applications) with a legal basis per purpose and retention per category.

For research participants, Article 14(5)(b) allows an exception where informing each person would be impossible or involve disproportionate effort, in particular for research, but the university must then make the information public and take other measures. Our research participant privacy notice template covers the details.

8. Data subject rights

Students, staff, applicants and participants have the rights of access, rectification, erasure, restriction, portability (for consent and contract) and objection (for public task). The university must answer "within one month of receipt of the request", extendable by two further months for complex cases (Art. 12(3)).

Three issues come up more often at universities than elsewhere:

1. Access requests in disputes. Students contesting a grade and staff in employment disputes often ask for everything, including emails. Our guide to subject access requests at universities covers exam scripts, emails and research data, with response templates. The EDPB Guidelines 01/2022 on the right of access are the main reference.
2. Erasure versus archiving. Public universities must often keep records under archive laws. The University of Copenhagen states that there is "no right to erasure of information that has been filed in the University's archives in accordance with the Archives Act". Article 17(3)(b) and (d) provide the exceptions this rests on.
3. Public access to documents. In Sweden and Finland in particular, documents held by public universities can be requested by anyone under freedom of information rules. Lund University notes that public documents are kept under the Freedom of the Press Act and the Archives Act. Privacy work and records management need to be coordinated.

Article 22 also matters as automated tools spread. Decisions based solely on automated processing that significantly affect a person, such as an automatic admission rejection, are only allowed in limited cases, with safeguards including human intervention.

9. When is a DPIA needed?

A data protection impact assessment is required before processing that "is likely to result in a high risk" to people (Art. 35(1)). The EDPB-endorsed WP248 guidelines give nine criteria; processing that meets two of them usually needs a DPIA. In higher education, student monitoring, special category data, new technology and the unequal relationship between university and student often add up to two.

Typical university processing that usually needs a DPIA: online proctoring, learning analytics and early warning systems, AI tools that assess or give feedback on student work, large research projects with health data, campus camera systems, and new student or HR systems. The controller must seek the DPO's advice when carrying out a DPIA (Art. 35(2)).

The University of Edinburgh shows a workable intake: staff email the DPO and "will be assigned an assessment through our online tool", and an existing DPIA for the same system can be reused. Reuse matters: if ten departments adopt the same platform, one well-maintained DPIA with local annexes is better than ten partial ones.

Start with our free DPIA screening tool, then use the DPIA template for universities. For specific high-risk areas, see online exams and proctoring and learning analytics.

10. Processors and vendor contracts

When a vendor processes personal data on the university's behalf, the university must use only processors that provide "sufficient guarantees" and must have a contract that meets Article 28(3). This applies to the learning platform, the student information system, cloud storage, survey tools and AI services, and to free tools that lecturers adopt on their own.

The vendor side of university compliance usually involves:

• A role analysis: is the vendor a processor, a controller for some purposes (for example product improvement or model training), or a joint controller? See our joint controller agreement guide for research consortia.
• A data processing agreement checked against all eight points of Article 28(3). Our DPA checker maps a draft against each point.
• A current subprocessor list with locations, and a way to notice and object to changes. Our subprocessor alerts tool helps with monitoring.
• Security evidence such as ISO/IEC 27001 certification or a SOC 2 report, checked for scope.
• For AI features: whether university data is used for training, and which AI providers are subprocessors.

Our pillar guide on vendor assessment for universities covers the full process from intake to exit, and our GDPR fact sheets summarise what vendors such as Canvas, Moodle, Microsoft 365, Google Workspace, Zoom and Turnitin document publicly. Unapproved tools are a separate problem; see shadow IT and unapproved AI tools.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

11. International transfers

Transfers of personal data outside the EEA are allowed only under Chapter V: an adequacy decision, appropriate safeguards such as standard contractual clauses (SCCs) with a transfer impact assessment, or a narrow derogation. Remote access from a third country, for example by a vendor's support staff, also counts as a transfer, so EU hosting alone does not settle the question.

For US vendors, the EU-US Data Privacy Framework adequacy decision (Implementing Decision (EU) 2023/1795) covers organisations on the DPF List. An appeal against the General Court judgment that upheld it is pending (Case C-703/25 P), so universities should know which vendors depend on it. Article 49(3) also says the consent and contract derogations do not apply to public authorities exercising their public powers, which limits them for public universities.

Transfers have been at the centre of several education cases. In 2022 the Danish Datatilsynet imposed a ban on Helsingør municipality's use of Chromebooks and Google Workspace in schools, including on transfers to third countries; it was later suspended and replaced with orders. Sweden's IMY fined Umeå University in a case that included sensitive data stored in a cloud service without adequate protection.

Read more: EU-US Data Privacy Framework for universities, transfer impact assessment template, the free transfer mechanism tool and the CLOUD Act and digital sovereignty.

12. Security and personal data breaches

Article 32 requires security appropriate to the risk. Article 33 requires the university to notify the supervisory authority of a personal data breach without undue delay and, where feasible, "not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk. Where the risk is high, the people affected must be told too (Art. 34).

The 72 hours start when the university becomes aware, not when the DPO hears about it, so the internal route has to be fast and known to every member of staff. University procedures show common patterns:

• Aalto University: a suspected breach "must be immediately reported by contacting the university's information security team"; the DPO handles notification to the Data Protection Ombudsman.
• Karolinska Institutet lists everyday examples for staff, such as an email sent to the wrong recipient, lost data and hijacked logins.
• Trinity College Dublin asks staff to report to the data protection office without delay and makes clear that reporting a breach is not treated as a disciplinary matter.
• NTNU separates security incidents (to its SOC) from privacy deviation reports, noting that a report "must describe the action, not the person who performed it".

Article 33(5) requires every breach to be documented, including those not reported to the authority. The EDPB Guidelines 9/2022 explain when notification is required. Our breach response guide, the breach response kit and the breach notification clock help prepare. Universities may also fall under national NIS2 rules; see NIS2 and universities.

13. Retention and archiving

Personal data must be kept no longer than necessary for its purposes (storage limitation, Art. 5(1)(e)), but data kept solely for archiving in the public interest or for research can be stored longer with safeguards. For public universities, national archive laws often decide what must be kept and for how long, so the retention schedule should be built with the archivist, not only the DPO.

Examples of how national rules shape retention:

• Lund University explains that, under the Swedish Archives Act (1990:782), personal data may be stored "in some cases indefinitely in the University's archive".
• Université Paris-Saclay keeps admitted applicants' data for 50 years under French archive rules: "Pour les candidats admis, elles sont ensuite conservées pour une durée de 50 ans".
• Utrecht University keeps raw research data "for at least ten years after publication of the research results", reflecting research integrity rules.

Vendor systems are where retention most often fails: a deleted record in the student system may live on in a survey tool, a video platform or backups. Our retention schedule template (Word file) includes a column for the systems that hold each record type.

14. Research and Article 89

The GDPR is relatively research-friendly. Article 9(2)(j) allows special category data to be processed for research based on Union or Member State law, and Article 89(1) requires safeguards, in particular data minimisation and pseudonymisation where possible. Article 89(2) lets national law limit some rights where they would seriously impair the research.

How this works varies a lot between countries, so a hub guide can only give the outline. Some examples:

• Utrecht University: "Conducting scientific research is a task of public interest entrusted to the UU", with explicit consent sought for special category data.
• University of Copenhagen: without consent, sensitive research data is processed under Article 6(1)(e) and section 10 of the Danish Data Protection Act, but only "if the processing is aimed at statistical or scientific studies with potential public interest".
• Trinity College Dublin uses Article 9(2)(j) with Article 89(1) safeguards, while noting that Irish health research regulations still require explicit consent for health research.
• University College Dublin Library reminds researchers that the GDPR "applies to any research that uses personal data, including scientific research and studies in the arts and humanities".
• In Norway, institutions with an agreement use Sikt's notification form; Sikt describes its role as "to advise and guide you on how to process personal data lawfully".

Students doing degree projects are a frequent blind spot. Uppsala University treats the university as controller for degree projects and tells students that "when processing sensitive personal data, consent must be obtained before the processing begins".

Go deeper with legal basis for research, research participant privacy notice, joint controller agreements, data sharing agreements, where to store research data and GDPR and AI tools in research.

15. AI tools and the EU AI Act

The GDPR applies to AI tools in the same way as to any other processing: a legal basis, a processor agreement, transfer checks and often a DPIA. The EU AI Act (Regulation (EU) 2024/1689) adds separate duties for universities as deployers. It does not replace the GDPR, and most AI tools in use at universities raise more GDPR questions than AI Act questions today.

The AI Act was amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026. On 9 October 2026 the position for universities is:

Validemic's analysis The GDPR questions to ask about any AI tool are: does the vendor use university data to train models, does that differ between free and institutional plans, which AI model providers are subprocessors and where are they, and does the tool make or support decisions about students that Article 22 might cover? Universities that answer these questions now will find the 2027 high-risk duties much easier.

Read more: the EU AI Act for universities, the AI Act explained, the AI Act checker for education, our AI policy template, AI tools approved at European universities and university-run AI services in the Nordics. Libraries negotiating AI clauses in content licences should see library licences, AI and text and data mining.

16. Enforcement: what universities and schools were fined for

Supervisory authorities have fined universities, not only companies. Whether a public body can be fined is for national law: Article 83(7) lets each Member State decide "whether and to what extent administrative fines may be imposed on public authorities and bodies". The cases below are taken from the authorities' own pages.

Validemic's analysis The pattern is consistent. Universities are rarely fined for exotic legal questions. They are fined for ordinary security (email, web servers), for adopting monitoring or biometric technology without a proper legal basis and DPIA, and for putting sensitive data into services that were not assessed. Each of these is preventable with the basics in the roadmap below.

17. Who does what at a university

The GDPR places responsibility on the university as controller, and in practice on its management and the business owners of each process. The DPO advises and monitors. Most of the actual work is done by other units, and gaps appear where each unit assumes another has checked something.

Write the split down. A short responsibility matrix, approved by management, prevents most disputes and makes the DPO's monitoring role possible. Our guides on library patron privacy and accessibility in procurement cover two areas where responsibility is often unclear.

18. A 12-month compliance roadmap

The plan below suits a university that has the basics on paper but needs to make them work. Adjust the order to your own gaps; a university with a recent breach will start with security. Each item should produce a document or decision.

Sources

1. Regulation (EU) 2016/679 (GDPR), Official Journal text, recitals 43 and 47, Articles 5, 6, 9, 10, 12 to 14, 17, 22, 28, 30, 32 to 39, 49, 83, 88 and 89 (retrieved 9 October 2026).
2. Regulation (EU) 2024/1689 (AI Act), Articles 4, 5, 26, 27, 50 and Annex III, and Regulation (EU) 2026/1744 (Digital Omnibus on AI).
3. Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework) and appeal in Case C-703/25 P.
4. EDPB Guidelines 1/2024 on processing based on Article 6(1)(f) GDPR, version 1.0, paragraphs 98 and 99 (retrieved 9 October 2026).
5. EDPB Guidelines 05/2020 on consent (retrieved 9 October 2026).
6. Article 29 Working Party, Guidelines on Data Protection Officers (WP243 rev.01) (retrieved 9 October 2026).
7. EDPB Coordinated Enforcement Action: Designation and Position of Data Protection Officers, report published January 2024 (retrieved 9 October 2026).
8. Article 29 Working Party, Guidelines on DPIA (WP248 rev.01) (retrieved 9 October 2026).
9. EDPB Guidelines 01/2022 on the right of access (retrieved 9 October 2026).
10. EDPB Guidelines 9/2022 on personal data breach notification (retrieved 9 October 2026).
11. Data Protection Commission (Ireland): Inquiry into University College Dublin and the decision of 17 December 2020 (retrieved 9 October 2026).
12. Garante per la protezione dei dati personali: decision of 16 September 2021 on Università Bocconi (docweb 9703988) and newsletter of 18 February 2020 (docweb 9266789) (retrieved 9 October 2026).
13. IMY (Sweden): Umeå universitet and Gymnasienämnden i Skellefteå kommun (retrieved 9 October 2026).
14. Autoriteit Persoonsgegevens: HAN University of Applied Sciences fined EUR 175,000 (retrieved 9 October 2026).
15. Datatilsynet (Denmark): decision of 14 July 2022 in the Chromebook case (Helsingør) (retrieved 9 October 2026).
16. ICO: Essex school reprimanded after using facial recognition technology for canteen payments, July 2024 (retrieved 9 October 2026).
17. Sikt: Notification form for personal data (retrieved 9 October 2026).
18. University of Oslo: Declaration on data protection (students) and Conditions for processing personal data (retrieved 9 October 2026).
19. Uppsala University: Data protection policy and GDPR in degree projects (retrieved 9 October 2026).
20. Lund University: Processing of personal data at Lund University (retrieved 9 October 2026).
21. Stockholm University: Processing of personal data at Stockholm University (retrieved 9 October 2026).
22. Karolinska Institutet: Report information security incidents and personal data breaches (retrieved 9 October 2026).
23. University of Helsinki: Data protection (retrieved 9 October 2026).
24. Aalto University: Aalto University data protection policy (retrieved 9 October 2026).
25. University of Copenhagen: Privacy policy (retrieved 9 October 2026).
26. NTNU: Information security: digital security incidents and deviations (retrieved 9 October 2026).
27. KU Leuven: Processing of student data and Processing of research participants' data (retrieved 9 October 2026).
28. University of Amsterdam: Privacy statement (retrieved 9 October 2026).
29. Utrecht University: Privacy statement for participants in scientific research and Data protection officer (retrieved 9 October 2026).
30. Trinity College Dublin: Legal basis for research and Data breaches (retrieved 9 October 2026).
31. University College Dublin Library: Research data management: GDPR (retrieved 9 October 2026).
32. University of Edinburgh: Data protection impact assessments (retrieved 9 October 2026).
33. Université Paris-Saclay: Applicant data processing notice (eCandidat), September 2026 (retrieved 9 October 2026).
34. Universidad Complutense de Madrid: Delegado de Protección de Datos (retrieved 9 October 2026).
35. Universitat de Barcelona: Data protection information (SICUE mobility) (retrieved 9 October 2026).
36. Universidade de Lisboa, Faculdade de Direito: Política de Privacidade (2021) (retrieved 9 October 2026).

About this page

Sources checked on 9 October 2026. We read the GDPR in the Official Journal version published by the EU Publications Office, the EDPB and Article 29 Working Party documents listed above, the supervisory authorities' own decision pages, and the data protection pages of the universities cited. Quotes from pages in other languages are given in the original with an English explanation. University examples show how one institution applies the GDPR under its own national law; they are not templates for every country. The AI Act timeline and the EU-US Data Privacy Framework are subject to change, and we will update this page when they do. Our own interpretation is labelled as Validemic's analysis. This page is general information, not legal advice. If you spot an error or an outdated point, please contact us and we will correct it.