When data protection authorities inspect your schools, you must be able to prove that every digital learning tool is accounted for, assessed, and safely managed.
Based on Edudata.io’s work with school privacy and security governance, we have put together this 5-point checklist to help education leaders become audit-ready.
Why Nordic Authorities Are Looking Closer
Nordic supervisory authorities (Datatilsynet in Norway, IMY in Sweden, and the Data Protection Ombudsman in Finland) are sharpening their focus on school technology.
In 2025, Datatilsynet reviewed 50 municipalities and found recurring gaps in software approvals, missing risk assessments, and lack of central vendor control. Their expectation is clear: municipal leadership must be able to demonstrate active governance over classroom technology.
The 5 Questions Every Education Director Must Answer
1. What digital learning tools are actually in use?
Auditors will want a complete overview of the digital learning tools used across your schools. This includes more than your main learning platforms. You should also know about browser extensions, communication tools, and AI tools used by teachers.
For each digital learning tool, you should be able to answer:
- Scope and Usage: Which schools, grades and staff members use the tool, and why?
- Data Footprint: What personal data does the tool process?
- Governance Status: Who approved the tool? Is the risk assessment up to date? Is there a valid data processing agreement?
Without a central overview, digital learning tools may be used without the necessary privacy checks. At Edudata.io we help municipalities keep a complete, up-to-date list of all active tools, making it easy to see who uses them, what data they touch, and whether they are approved.
2. Are our DPIAs up to date?
A Data Protection Impact Assessment (DPIA) should be updated when a digital learning tool changes or gets new features. It should reflect how the tool is used in your schools today, not only how it was used when it was first introduced.
Depending on the type of data and tool, European data protection rules may require a DPIA. You need to do your own assessment and show how the tool is used and what measures protect students’ data.
Education leaders should know which tools have a DPIA, when it was last reviewed, and what safeguards are in place.
3. What do our vendors process?
Even when a supplier runs the service, the municipality remains responsible for student data. Auditors will therefore check whether your agreements with suppliers match how the digital learning tools are actually used.
|
Key Area
|
What Leadership Must Verify
|
|
Processing Purpose
|
Does the vendor process personal data strictly on municipal instructions, without repurposing data for commercial or model-training purposes?
|
|
Sub-processors
|
Are all third-party sub-processors mapped, approved, and compliant with EU/EEA transfer rules?
|
|
Changes
|
Is there an active routine to review software updates when vendors introduce new data-collection terms?
|
If a supplier silently adds an AI feature or alters its terms of service, an outdated DPA exposes the municipality to significant compliance risk.
4. How do we approve new tools?
New digital learning tools should always be checked before they are used in the classrooms.
The Ålesund Municipality case showed what can happen when clear routines are missing. Datatilsynet found that the municipality had not carried out basic security checks or a required DPIA for a tool used in physical education.
Teachers should have a simple way to suggest new tools. The municipality should then assess and approve them before they are used with students.
5. Can we report compliance today?
If an inspector contacts your municipality, you should be able to find the necessary information quickly.
Being ready for an audit requires instant access to:
- Approved digital learning tools and their users
- Current DPIAs and risk assessments
- Data processing agreements
- Records of processing activities (ROPA) and review dates
This information should be kept up to date. With Edudata.io municipalities keep all assessments, supplier agreements, and compliance records in one place, so you can pull up the right documents right away.
Always Audit-Ready with Edudata.io
An audit should never catch municipal leadership off guard. When you have a clear, up-to-date overview of the tools, risks, and vendor agreements across your schools, answering supervisory authorities becomes much easier and less stressful.
Edudata.io helps education providers maintain continuous control over privacy, AI risks, and security documentation in one place. Explore Edudata’s service options to see how our tools support audit readiness across your organisation, and book a demo.
