Imagine a private school preparing a portal for families. It receives a contract template used by a municipality and considers adopting it. Some provisions may be useful, but the municipality’s public status and the school’s activities do not necessarily fall under the same rules.
The first question concerns the organisation and the task. Cantonal education oversight and data protection address different matters. Connecting them allows the contract to describe the service actually planned.
Distinguish the school’s status from its activities
A private school is generally subject to the federal FADP for private processing. The canton retains its education responsibilities, including authorisation and supervision. In Vaud, the private education act describes the relevant framework.
A delegated public task or another specific regime may change the analysis for some processing. Funding and recognised missions therefore need examination in context. The school identifies the responsible entity and activity before choosing a template.
For the portal, it describes functions such as informing parents, sharing documents or handling administrative requests. It distinguishes those uses from medical records and internal assessments. One application may support several processes with different users and access rules.
This description also identifies each provider’s role. A host processing on the school’s instructions may occupy a different position from a service that decides to reuse information for its own purposes.
Classify the data before granting access
Contact details, results and photographs are personal data when they concern identifiable pupils. That does not make every item legally sensitive. Health information and some social-assistance information require particular qualification.
High-risk profiling describes processing, not simply a set of pupil profiles. The FDPIC explains that concept and the FADP’s mechanisms. Combining information to evaluate a person raises questions different from displaying an address.
This classification guides access. A parent can see authorised information without opening another family’s files. Teachers and administrative or health staff may have different needs. Changes in legal representatives and particular family situations belong in the design and tests.
Consent does not automatically resolve these matters. For a minor, capacity of judgement and purpose matter alongside the rules governing parental authority. The school determines the relevant basis instead of requesting one general agreement for every future use.
Translate decisions into the portal and contracts
The provider should explain processing locations and technical access, including other providers involved. The school examines retention and export as well as backups. Limited access in the visible interface is insufficient if wider technical access remains uncontrolled.
The team tests accounts representing the different roles. An allowed action and a forbidden action establish more than a generic permissions statement. Closing an account and recovering a document also need verification.
Information for families explains the purposes and useful contacts in understandable language. A multilingual school may need several versions. The text must match the functions actually enabled and the provider terms agreed.
Maintain the record and prepare incident handling
An inventory connects each portal function with its data, authorised users and retention period. It remains useful even where the school believes an exemption from the statutory processing register applies. That exemption depends on conditions; size alone is insufficient, notably for large-scale sensitive processing or high-risk profiling.
Article 24 FADP requires notification to the FDPIC as soon as possible when a security breach is likely to create a high risk for the people concerned. The GDPR’s 72-hour period belongs to another regime whose territorial scope must apply. A family’s nationality alone does not establish that scope.
The school assigns contacts and responsibility for assessment, and identifies the information the provider must supply. A simple exercise involving a document visible to the wrong family can test access removal and the availability of evidence.
| Record | Decision it helps verify |
|---|---|
| Function and purpose | The use matches the stated task |
| Data categories | The portal collects the necessary information |
| Roles and accounts | Recipients have the intended access |
| Providers and locations | The agreement reflects the processing chain |
| Retention and export | The school can manage the life of the records |
Accreditation bodies or insurers may also request some of this material under their own requirements. Its primary purpose is to keep the legal framework, contract and daily portal operation consistent.
Sources and scope
The portal is hypothetical. The school’s status, canton and tasks determine the legal assessment needed for an actual project.