Personal data protection in schools: when a data protection officer is mandatory

In our assessment, a state or municipal school must have a data protection officer. This does not depend on the number of pupils or on what data the school processes. It depends on what the school is. The General Data Protection Regulation (GDPR) ties the duty to a public authority or body (Article 37(1)(a) GDPR), and in Lithuania that notion is defined in Article 2(2) of the Law on the Legal Protection of Personal Data (ADTAĮ). For a non-state school the answer is not self-evident: it has to be assessed and written down.

Below: what the Law on Education itself provides for, what legal basis a school relies on, when a data protection officer is mandatory and what is at stake without one.

The school as data controller

The controller is whoever determines the purposes and means of processing. Where the purposes and means are set by law, that law may also designate the controller (Article 4(7) GDPR). The Law on Education (ŠĮ) provides that a state or municipal school is a public legal person operating as a budgetary institution or a public institution, and a non-state school is a legal person (Article 43(1) ŠĮ). So the school itself, not the municipality, is responsible for the data of pupils, parents and staff that it processes in its own work.

Not all processing the school takes part in belongs to it, though. The Law on Education provides for several central systems and school duties:

• The Ministry of Education, Science and Sport establishes and manages the information systems of the Pupils’ Register and other education registers. It is the controller of the data in these systems, including personal data (Article 56(1)(6) ŠĮ). The Pupils’ Register holds data on pupils, their programmes, their school, the organisation of their education, their achievements and the education they have attained (Article 76(2) ŠĮ).
• The ministry is also the controller of the Education Management Information System (ŠVIS) and the data in it (Article 73(2) ŠĮ).
• Applications for admission to state and municipal schools, the waiting list, approval of the lists of admitted pupils and the processing of pupils’ data are handled centrally, under a procedure set by the minister (Article 29(2¹) ŠĮ, in force since 1 January 2026).
• A school may run general education programmes only if its registers for recording education are kept as electronic class registers (Article 43(8)(3) ŠĮ).

The ministry is the controller of the Pupils’ Register and ŠVIS. The Law on Education does not say who controls centralised admission or electronic class registers: admission is administered by the public institution “Mokausi Lietuvoje” (Article 29(8¹) ŠĮ), and for the electronic register the school must assess its own role (Article 4(7) GDPR). If a provider processes the register data on the school’s behalf, a contract or other legal act under Article 28(3) GDPR is needed. The school is responsible for what it collects itself, who it passes it to and how long it keeps it.

Why children’s data are held to a higher standard

The GDPR states that children merit specific protection of their personal data, because they may be less aware of the risks, consequences and safeguards and of their rights (Recital 38 GDPR). The articles reflect this too: when legitimate interests are weighed, the interests of a child receive particular weight (Article 6(1)(f) GDPR).

A pupil’s data is more than a name and grades. Special educational needs may arise from congenital or acquired disorders (Article 2(26) ŠĮ), and the pedagogical psychological service assesses them also from a medical perspective (Article 14(3) ŠĮ). Information linked to them may reveal a child’s health. Processing health data is prohibited unless one of the exceptions in Article 9(2) GDPR applies (Article 9(1) GDPR).

What legal basis a school relies on

A school processes data because a law requires it, or because it carries out the public task assigned to it: education. These are two GDPR bases: a legal obligation (Article 6(1)(c) GDPR) and a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e) GDPR). In both cases the basis must be laid down in EU or Member State law (Article 6(3) GDPR). For a school, that is the Law on Education and the legal acts adopted under it. Public authorities may not rely on legitimate interests when performing their tasks (Article 6(1), second subparagraph, GDPR).

Consent fits only where parents or the pupil can genuinely refuse or withdraw consent without detriment (Recital 42 GDPR). The GDPR says consent should not be a legal basis where there is a clear imbalance between the parties, in particular where the controller is a public authority (Recital 43 GDPR). Class lists, grades and attendance are not based on consent. When consent is valid is covered in our article on consent under the GDPR. How this works for photos when parents disagree is discussed in our article on children’s photos at school.

When a school must have a data protection officer

A data protection officer must be designated where processing is carried out by a public authority or body, except for courts acting in their judicial capacity (Article 37(1)(a) GDPR). The GDPR does not define this notion. The Article 29 Working Party, in its Guidelines on Data Protection Officers (WP 243 rev.01), stated that it is to be determined under national law.

Article 2(2) ADTAĮ treats as public authorities and bodies state and municipal institutions and bodies, enterprises and public institutions. They must meet two conditions:

• They are financed from state or municipal budgets and state monetary funds.
• They are authorised under the Law on Public Administration to carry out public administration, or provide public or administrative services to persons, or perform other public functions.

A state or municipal school is a budgetary or public institution whose owner or one of whose members is the state or a municipality (Article 43(1) and Article 2(25) and (37) ŠĮ). Its formal education programmes are financed with teaching funds from the state and municipal budgets (Article 67(1) ŠĮ). In our assessment, providing education is a public service or public function within the meaning of this definition. A data protection officer is therefore mandatory for such a school, however many pupils it has and whatever data it processes. The criteria for other organisations are covered in our article do we need a data protection officer.

Non-state schools: the answer has to be assessed

A non-state school is a school whose owner, or one of whose members, is not the state or a municipality (Article 2(20) ŠĮ). A school whose members include both the state or a municipality and private persons can meet both definitions in Article 2(20), (25) and (37) ŠĮ, so this assessment applies to it as well. A non-state school needs to check three routes.

The ADTAĮ definition. Article 2(2) ADTAĮ also names public institutions financed from budgets. Teaching funds are allocated to non-state schools as well (Article 67(1) ŠĮ). Whether the words “state and municipal” govern every form listed, or whether a public institution with private members also falls within the definition, the text of the law does not answer unambiguously. A non-state school that operates as a public institution and receives teaching funds should not dismiss this risk without an assessment.

Large-scale monitoring. The duty arises where the core activities consist of processing operations which require regular and systematic monitoring of individuals on a large scale (Article 37(1)(b) GDPR). In our assessment, education is not in itself monitoring in this sense. The assessment may change if the school continuously monitors pupils with cameras or with systems that analyse their behaviour: the Guidelines list closed circuit television among the examples of monitoring.

Special category data on a large scale. The duty arises where the core activities consist of processing special categories of data on a large scale (Article 37(1)(c) GDPR). The Guidelines treat as a core activity also processing that is an inextricable part of the activity. In our assessment, for a general education school that processes health data only as far as needed to help individual pupils, this criterion is hard to meet. For a school whose activity is the education of pupils with special educational needs, it needs careful assessment.

The Guidelines recommend documenting the internal analysis of why a data protection officer is or is not designated, unless the answer is obvious, and recommend as good practice that private organisations carrying out public tasks designate one. According to the Guidelines, a data protection officer designated voluntarily is subject to the same requirements of Articles 37–39 GDPR.

One data protection officer for several schools

Where the controller is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size (Article 37(3) GDPR). The officer may be a staff member or work under a service contract (Article 37(6) GDPR). The Guidelines add that the controller must ensure that such an officer, with a team if necessary, can perform the tasks efficiently for all the bodies. Each school remains a separate controller: it publishes the officer’s contact details and communicates them to the supervisory authority (Article 37(7) GDPR).

What the officer does and who cannot be one

The officer informs and advises the school and its staff, monitors compliance with the GDPR, advises, where requested, on data protection impact assessments and cooperates with the State Data Protection Inspectorate (Article 39(1) GDPR). The school must involve the officer in all data protection issues in good time (Article 38(1) GDPR). The officer receives no instructions on how to perform the tasks and reports to the highest management (Article 38(3) GDPR). The officer’s other duties must not create a conflict of interests (Article 38(6) GDPR). So a head of school or a deputy who decides what data the school collects cannot be the officer: they would be supervising their own decisions. The Guidelines state that the officer cannot hold a position that leads him or her to determine the purposes and means of processing, and that this is considered case by case.

What can happen

If no data protection officer is designated, or the officer lacks independence, the requirements of Articles 37–39 GDPR are breached. These are infringements listed in Article 83(4)(a) GDPR. A state or municipal school may be fined for them up to 0.5 percent of the body’s current-year budget and other gross annual income received in the previous year, but not more than thirty thousand euros (Article 33(1) ADTAĮ).

For processing without a legal basis or on invalid consent (Article 83(5)(a) GDPR), the limit is up to 1 percent of the same income, but not more than sixty thousand euros (Article 33(2) ADTAĮ). If the body carries out commercial economic activity, the general GDPR fines apply (Article 33(3) ADTAĮ).

A non-state school that is not a public body faces the general GDPR limits: up to ten million euros or, for an undertaking, up to 2 % of annual worldwide turnover, whichever is higher (Article 83(4) GDPR), and for breaches of the principles and legal bases up to twenty million euros or up to 4 %, whichever is higher (Article 83(5) GDPR). What else a public body faces besides a fine is covered in our article on GDPR fines for state and municipal institutions.

When to call a lawyer

• when the school has no designated data protection officer or has not communicated the officer’s contact details to the supervisory authority;
• when the officer’s role is held by the head of school, a deputy or the IT administrator;
• when you are a non-state school and do not know whether the definition in Article 2(2) ADTAĮ applies to you;
• when a municipality plans one data protection officer for several schools;
• when processing relies on parents’ consent although parents cannot realistically refuse;
• when you have received an inquiry from the State Data Protection Inspectorate or a complaint from parents.