Latest posts
-
How to Respond When an Edtech Vendor Loses Your Students’ Work (2026)
Your processor had the incident; you have the notification duty. Ten steps from the vendor’s email to the regulator’s file, with the owner and artefact for each — and the 72-hour clock that starts when you become aware, not when you finish investigating.
-
Can Our Staff Put Student Work Into an AI Tool?
Not into a personal account. A marker who pastes a chapter into their own chatbot has disclosed a student’s personal data to a company the institution has no contract with — and under Article 28(10) that company is a controller in its own right, not your processor.
-
Can a University Rely on Student Consent to Deploy an AI Writing Tool?
Almost never, and the reason is in Recital 43. The EDPB states that a public authority is unlikely to be able to rely on consent at all — and Article 6(1) then removes legitimate interests from public bodies acting in their public task. Which leaves one basis standing.