Data protection for learning platforms: DPA and transfers

Under Article 4(7) GDPR the controller is whoever determines the purposes and means of processing. A company using a learning platform to train staff decides who gets which courses and what the data are for — it is the controller. The provider running the platform on its instructions is a processor under Article 4(8). The same applies to universities: the university is responsible for processing its students' data, and the platform operator processes on its behalf.

Roles can shift. If a provider uses learning data for its own purposes, such as training its own models or marketing courses, it becomes a controller to that extent — and needs its own legal basis. If two parties jointly determine purposes and means, they are joint controllers under Article 26 and need an arrangement on who fulfils which duties.

Article 28(1) requires using only processors that provide sufficient guarantees of appropriate technical and organisational measures. Paragraph 3 requires a contract setting out the subject matter, duration, nature and purpose of processing, the type of data, the categories of data subjects and the controller's rights and obligations. The contract must in particular provide for the following:

Modern learning platforms rely on further services: data centres, email delivery, language models, speech synthesis, video services. Each is a sub-processor if it processes personal data. Under Article 28(2) the provider needs the controller's prior specific or general written authorisation; under a general authorisation it must inform the controller of changes and give it the opportunity to object.

If a service is located outside the European Economic Area, or data can be accessed from a third country, Articles 44 ff. apply. A transfer is lawful if the Commission has found the level of protection adequate (Article 45), if appropriate safeguards such as the Commission's standard contractual clauses are in place (Article 46), or if a derogation under Article 49 applies. Since the judgment of the Court of Justice of 16 July 2020 (C-311/18), users of standard contractual clauses must assess whether the third country's law undermines their effectiveness.

For the United States the Commission adopted an adequacy decision for certified organisations in July 2023. Whether and how long it stands also depends on judicial review; check the current status before signing. The safest solution for learning data is processing entirely within the EU, including any AI and speech services used.

Learning platforms generate a lot of data: progress, answers, assessment results, time spent, chat histories with AI tutors. Purpose limitation (Article 5(1)(b)) requires defining beforehand what these data will be used for. If they are used to monitor performance or conduct, German companies must also respect the works council's co-determination rights.

Camera-based proctoring is particularly sensitive. It may involve biometric data (Article 9) and usually requires a data protection impact assessment under Article 35. Data-minimising approaches — such as single photos instead of video, short retention and access only when a case arises — reduce the risk. Decisions on assessment results based solely on automated processing are, in principle, not permitted under Article 22. And where AI evaluates learning outcomes or monitors exams, Annex III point 3 of the AI Act may make it a high-risk system.

Before introducing a learning platform, a structured review pays off. The following questions cover the most common gaps; the answers belong in the controller's documentation.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.