LGPD in Schools: How to Protect Personal Data

A student enrollment form can include a child’s address, identification documents, contact details, and health information. Brazil’s LGPD in schools sets out how public and private institutions should collect, use, store, and share this information.

To comply with the law, each processing activity needs a purpose, a legal basis, and access and security controls proportionate to the risk.

This applies to students, parents and guardians, teachers, and staff, as well as paper records, emails, spreadsheets, and digital platforms. Schools can use personal data for educational and administrative activities, provided they can justify its use and protect the people involved. The most practical approach is to review each routine: what information is collected, who needs it, how long it will be kept, and what to do if someone accesses it without authorization. A signed enrollment form, by itself, does not cover every future use.

Key takeaways

Public and private schools must identify a purpose and legal basis for each data processing activity.
Health information and biometric data are sensitive personal data and require safeguards proportionate to the risk.
The child’s best interests must guide the processing of their data under the LGPD.
Spreadsheets and apps can be used after evaluating access, security, purpose, and the provider’s terms.

LGPD in schools: responsibilities for students, families, and staff

The LGPD is Law No. 13,709/2018, Brazil’s law regulating the processing of personal data by individuals and public or private entities. For schools, this means organizing each use of information around a legitimate purpose, legal basis, appropriate access, and security measures, from enrollment through staff management.

The law applies to both digital and physical records. The front office may verify a parent’s or guardian’s identity; school administrators may document an incident; the school nurse may review health information; and the communications team may select photos from a school event.

Each task involves authorized users, different data, and specific risks.

As a first step, school leadership should list data processing activities and assign people to review them. This inventory can uncover unnecessary access that goes unnoticed in the day-to-day work, such as keeping a contact spreadsheet available to all staff when only the front office needs it.

Record the purpose and legal basis for each activity.
Limit access to people who need the data for a specific task.
Set rules for storage, deletion, and reviewing retention periods.
Review vendors’ contracts, permissions, and security measures.
Decide who will handle requests from data subjects and coordinate incident response.

Brazil’s Lei Geral de Proteção de Dados Pessoais (General Personal Data Protection Law, or LGPD) remains the primary legal reference. For current supplementary rules and guidance, schools should consult Brazil’s Autoridade Nacional de Proteção de Dados (ANPD), the country’s National Data Protection Authority. How the law applies in a specific case may depend on the purpose, context, and legal basis chosen; complex situations may require legal advice.

Proteção de informações de saúde infantil

Children’s and teenagers’ data: health information, images, and biometrics

Personal data is information relating to an identified or identifiable person. Names, addresses, phone numbers, and school records are examples. Health information and biometric data linked to an individual are sensitive personal data, subject to the specific legal grounds and safeguards set out in the LGPD.

Information about an allergy or medication may be needed in an emergency, but it does not need to be shared with every staff member. Schools should limit access to people who need to act on it and avoid exposing diagnoses on open lists, bulletin boards, or group chats. The same care applies to medical reports, disability information, and counseling records.

When processing children’s and teenagers’ data, schools must consider their best interests. The ANPD provides guidance on applying the law to this group in its statement on the processing of children’s and teenagers’ personal data, which should be read alongside the LGPD and the circumstances of the activity.

Photos and videos at school events

An identifiable image is personal data. Taking photos of a performance for internal records and posting a video on social media are different uses, with different audiences and risks. Schools should therefore explain each purpose and identify the appropriate legal basis, rather than assuming that general enrollment consent covers public disclosure.

Biometrics and school apps

Before adopting facial recognition or fingerprint scanning to manage entry, school administrators should ask whether a less intrusive alternative, such as an access card or manual check, is available and whether collecting the data is necessary for the stated purpose. Biometric data should not be collected just for convenience, especially when children and teenagers are involved.

Apps for assignments, attendance, or communication may also collect student data. Schools should review what information the provider collects, who manages the accounts, whether data is shared with third parties, and how it is deleted when the contract ends. A tool may be appropriate for one activity but excessive for another.

Família decide sobre fotos na escola

Legal bases, consent, and students’ rights

What are the LGPD’s principles and legal foundations?

The law does not set out a list of “seven legal foundations.” It distinguishes between foundations, principles, and legal bases: foundations appear in Article 2, principles in Article 6, and legal bases, among other provisions, in Articles 7 and 11. The principles include purpose, adequacy, necessity, transparency, security, prevention, and accountability; the statutory list includes more than seven items.

Students or their representatives can exercise rights provided by the LGPD, such as requesting confirmation that their data is being processed, access to it, and correction of incomplete or outdated information. Schools should provide a channel for requests, verify the requester’s identity, and forward the request to the responsible team. Not all information can be deleted immediately: legal obligations and other applicable legal bases may require it to be retained.

Arquivos organizados com acesso controlado

Inventory, access, retention, and vendors

A useful inventory describes data processing in a way that another person at the school can understand without relying on informal knowledge. For each routine, record the purpose, data categories, who has access, the system or file used, any vendor involved, the legal basis, and the retention criteria.

Activity	Purpose	Recommended access	Review
Enrollment	Formalize enrollment and complete school procedures	Front office staff and professionals with related responsibilities	When forms or retention rules are updated
Health record	Support the student and respond to care needs	Staff who need the information to assist the student	When the information is outdated or the need changes
Event photography	Internal recordkeeping or publication, depending on the stated purpose	Staff responsible for the archive or publication	Before each new type of publication
Access control	Verify access to school facilities	Staff responsible for access control	Before expanding collection or retaining biometric data
School platform	Carry out specified academic or administrative tasks	Individual accounts based on role	When the service is purchased, renewed, or changed

There is no single retention period that works for every school record. Schools should consider the purpose, legal and regulatory obligations, and the need to defend legal rights, then establish secure deletion or anonymization when retention is no longer necessary. So the question of how long to keep records needs an answer for each document category, not a blanket rule.

Vendors that operate school systems should be evaluated before they are hired. Contracts should clarify responsibilities, security measures, support for data subject requests, subcontracting, and incident procedures. Schools should also review permissions when an employee changes roles or leaves the institution.

Spreadsheets, email, WhatsApp, and sharing information

Common tools are not automatically incompatible with the LGPD. The risk depends on the data shared, who receives it, the settings, and the purpose. For example, sending an attendance list to a large group may reveal information that other parents and guardians do not need to know.

In practice, problems arise when staff reuse an old spreadsheet and leave access enabled for people who no longer work on that project. Reviewing access should be part of wrapping up every activity, along with checking recipients before sending an email with attachments.

Before sharing data, check whether the recipient needs every field and use institutional channels with individual accounts and access controls whenever possible. Avoid posting health information in group chats, and don’t forward student photos for purposes beyond the communications shared with parents and guardians. Everyday tools can be used in an organized way without turning every interaction into excessive data collection.

The same principle applies to an activity involving a diagnosis or specific need: share only what staff need to carry it out, without exposing the student’s full history. When looking for other systems or services, schools should evaluate their safeguards and terms of use rather than relying on a tool’s popularity.

Data breaches: school response and responsibilities

A security incident may involve the loss, alteration, unauthorized access, or disclosure of personal data. If a school discovers an exposed spreadsheet, a lost device containing files, or a message sent to the wrong recipient, it should contain the problem, preserve information that may help with the investigation, and document what happened.

Stop the exposure. Revoke public links, lock compromised accounts, or request removal of the content, without deleting evidence needed for the investigation.
Document what happened. Note when the school learned of the incident, what data was affected, how many people may be involved, and what steps have already been taken.
Assess the risk. Consider the nature of the data, the potential harm to data subjects, and whether children, health information, or biometric data are involved.
Decide who to notify. The LGPD requires notification to the ANPD and data subjects when an incident may cause significant risk or harm, under the applicable regulations.
Address the cause. Update permissions, processes, or contracts and assign someone to follow up on outstanding actions.

The data protection officer serves as a point of contact between the institution, data subjects, and the ANPD, in line with the responsibilities applicable to the case. Schools should decide who receives incident reports and who makes decisions, even if the institution does not have a dedicated privacy team. The ANPD explains the process on its security incident page.

Cell phones and technology in schools in 2026

Law No. 15,100/2025 regulates students’ use of personal portable electronic devices in basic education in Brazil. It restricts their use during classes, recess, and breaks, with exceptions for purposes such as teacher-directed educational activities, accessibility, inclusion, health, and the exercise of rights. Schools should consult the law and applicable rules when setting their own policies.

Cell phone rules and data protection are related but separate issues. Restricting phone use during class does not remove the duty to protect data in school platforms, photos, attendance records, or access control systems. If a school allows a device for an activity, it should explain which tool will be used, what data will be collected, and who can access it.

Schools should also distinguish students’ personal devices from digital resources provided by the institution. An internal policy can set out schedules, exceptions, and emergency procedures; data processing by apps or equipment is still subject to the LGPD. For student activities, avoid requiring a personal account with an outside service without first assessing whether it is necessary and what alternatives are available.

What the LGPD allows and how schools can apply its rules

The LGPD does not provide a simple list of school activities that are prohibited. Processing may be allowed when it has a legitimate purpose and an appropriate legal basis, with suitable safeguards. Practices such as collecting unnecessary data, reusing it for an incompatible purpose, or making it accessible to people who do not need it may violate the law, depending on the circumstances.

The first management step is to choose a specific routine, such as enrollment or publishing photos, and complete the inventory with its purpose, legal basis, access, and retention period. Then review whether every form field is necessary, adjust permissions, and document who handles requests and incidents. To check for legal changes and additional guidance, consult the current text of the law and the ANPD’s official materials.

Frequently asked questions

Does the LGPD apply to small schools?

Yes. An institution’s size does not exempt it from the law, although specific rules may take into account the size and nature of the data controller or processor.

Can teachers keep student data in their own spreadsheets?

Use must follow the school’s guidance, have a defined educational or administrative purpose, and include access and security controls. Personal spreadsheets without institutional oversight make it harder to update permissions, end access, and respond to incidents.

Can schools post student photos on social media?

Schools may process images for publication when there is an appropriate legal basis and they follow the rules that apply to children and teenagers. They should explain this purpose, limit exposure, and avoid treating permission for internal recordkeeping as automatic approval for public posting.

Is a full-time data protection officer required?

The LGPD provides for a data protection officer, but how the requirements are met depends on the rules applicable to the data controller or processor and its organizational structure. Schools should provide a point of contact and assign responsibility for handling requests from data subjects and communications with the ANPD.

Is there an official PDF template for applying the LGPD in schools?

Templates can help organize policies and inventories, but they do not replace a review of the institution’s routines. Schools can consult official ANPD materials and adapt documents to their purposes, systems, and retention periods.

Does Brazil’s Ministry of Education directly enforce the LGPD in schools?

The ANPD is responsible for enforcing data protection rules, without limiting the authority of other agencies in their respective areas. Public schools must also follow administrative and education rules that apply to their records.

Brazil’s LGPD in Schools: Protecting Student, Family, and Staff Data