Learning platforms and data protection: checking EU hosting

Even a simple LMS processes a lot of personal data: name, email address, organisation, role, login times, courses opened, answers to exercises, exam results, certificates. Modern platforms add AI features: questions to a tutor, spoken answers, recordings for a personal avatar, camera images in proctored exams.

Some of this data is particularly sensitive. Exam results can influence graduation or promotion. Voice and image recordings are personal and, when processed to uniquely identify someone, can count as biometric data under Article 9 GDPR. The more features a platform offers, the more closely you need to look.

The organisation that uses the LMS is usually the controller under the GDPR. The vendor processes data on its behalf. This creates clear obligations on both sides.

Many vendors advertise servers in Germany or the EU. That is a good start but does not answer every question. What matters is where every processing step takes place, not just storage in the database. A learning platform often calls further services: language models for answers and authoring, speech synthesis, speech recognition, image generation, email delivery, payment processing and error monitoring.

If one of these services is located outside the EU, data is transferred to a third country, and Articles 44 onwards of the GDPR apply. That can be lawful, for example on the basis of an adequacy decision or standard contractual clauses, but it must be a conscious, documented decision. So ask for the complete list of sub-processors with their locations and what each one receives.

Data in a learning platform must not sit there forever. At the same time there are retention obligations: records of compliance training may have to be available for years, and so may exam documents at universities. A good platform therefore distinguishes between deletion, restriction and anonymisation and lets you set periods per data type.

Make sure deletions actually take effect, including in backups once those expire, and that a report shows what was due and what has been done. In front of a supervisory authority, the result counts, not the plan.

For most AI features, a language model does not need personal data. To answer a question about a slide, the course content and the question itself are enough. Name, email address and account ID have no place in the model call. Ask vendors how they ensure this.

For features involving voice and image, such as a personal avatar, documented consent from the person depicted is required, and it must be revocable at any time. Revocation should take effect immediately, not weeks later.

In Universe, user data, exam results and certificates are stored in a database in Frankfurt; the application runs in an EU region, and an automated test fails as soon as a region outside the EU is configured. Speech recognition runs in the EU and would rather refuse service than fall back to a provider outside it. Language models receive course content and the question, not names or account data. Deletion, restriction and anonymisation are kept separate, with a deletion calendar and a report to the data protection officer.