Data Protection Impact Assessment (DPIA)
EduGPT
Organisation:
CivAI B.V. (EduGPT)
Version:
2.1
Date:
14 October 2026
Status:
Final, updated after the pilot phase
Next review:
Q4 2026
Contact:
privacy@edugpt.nl
Management Summary
EduGPT offers European educational institutions a GDPR-compliant alternative to ChatGPT. Following the completed pilot phase (October 2025 – January 2026), EduGPT is available for implementations, with new educational implementations from school year 2026-2027. The platform runs on Scaleway within the EU (data centres in France and the Netherlands), outside the scope of the US CLOUD Act, and only processes personal data that is necessary for delivering AI services. Azure OpenAI in the Sweden Central region in Sweden, exclusively Data Zone Standard within the EU Data Zone (EU member states, Norway and Switzerland), is available exclusively at the institution's request. Scaleway is the default and is recommended.
Key Characteristics
- Users: Teachers, educational support staff, researchers and (optionally, at the institution's initiative) students
- Location: Data remains within the EEA (Scaleway, France/Netherlands)
- Training: No use of data for AI training
- Logging: Full audit logging
- Control: The institution centrally determines which AI models are available
Risk Classification
| Risk Level | Description | Measures |
|---|---|---|
| HIGH | Unintended processing of special categories of personal data | Technical and organisational measures |
| MEDIUM | Possible data breaches, AI hallucinations | Encryption, training, disclaimers |
| LOW | Unauthorised access by third parties | Access control, MFA |
1. Description of the Data Processing
1.1 Context and Problem
More than 70% of teachers and students use ChatGPT or similar tools through private accounts for study and work purposes. This creates substantial risks:
- • GDPR violations due to data processing outside the EU
- • Shadow IT via WhatsApp and private tools
- • No control over educational data
- • Training of AI models on sensitive data (e.g. pupil reports)
1.2 EduGPT Solution
EduGPT offers a secure alternative that:
- • Offers the same ChatGPT functionality
- • Keeps data within the EEA (Scaleway data centres in France and the Netherlands)
- • Performs no training on user data
- • Provides audit trails for accountability
- • Delivers European support
1.3 From Pilot to Implementation
- Pilot phase: October 2025 – January 2026, completed (max. 10 educational institutions, max. 20 users per institution)
- Outcome: go decision for implementations; findings incorporated in this DPIA version 2.0
- Implementations: new educational implementations from school year 2026-2027 (September 2026)
- Safeguarding: for each implementation, this DPIA is reviewed together with the institution for its specific context
2. Personal Data
2.1 Overview of Personal Data
| Category of data subjects | Type | Personal data | Source |
|---|---|---|---|
| Users (teachers, students, staff) | Regular | Name, email address, job title, institution | Registration by user |
| Users | Regular | IP address, browser info, timestamps | System logging |
| Users | Regular | Prompts, chat history | User interaction |
| Third parties (in documents) | Unknown | Potentially all categories, incl. special categories | Documents uploaded by users |
2.2 Critical Risks
Warning: Users may upload documents containing personal data of pupils or students, such as:
- • Medical data (dyslexia, ADHD)
- • Study progress, grades, guidance reports
- • Behavioural or care information
- • Financial data (student finance, payment arrears)
3. Processing Activities
3.1 Overview of Processing Operations
| Processing | Personal data | Purpose |
|---|---|---|
| Registration | Name, email, institution | Create account |
| Authentication | Email, password | Grant access |
| Storage | All user data | Deliver service |
| AI-processing | Prompts, documents | Generate answers |
| Logging | All actions + metadata | Audit trail, security |
| Backup | All data | Continuity |
| Deletion | All data | At user's request |
3.2 Excluded Processing
No processing for:
- ❌ Marketing
- ❌ Product development
- ❌ Sale to third parties
- ❌ Profiling
4. Parties Involved
| Party | Role | Functions | Access to |
|---|---|---|---|
| CivAI B.V. (EduGPT) | Processor | Platform management, support | All data (encrypted) |
| Scaleway S.A.S. | Sub-processor | Hosting and AI inference (default, EU) | Encrypted data, no keys |
| Microsoft Ireland | Sub-processor (optional) | Azure OpenAI (AI, exclusively on request; Scaleway is the default and is recommended) | Encrypted data, no keys |
| Educational institutions | Controller | Determine use | Data of own users |
| Users | Data subject/inputter | Use of platform | Own data |
5. Technical and Organisational Measures
5.1 Processing Locations
- Primary hosting: Scaleway (EU, France/Netherlands)
- Backup: Within the EEA (Scaleway)
- Support: CivAI office (Netherlands)
- ❌ No transfer outside the EEA (default Scaleway route)
5.2 Technical Specifications
- AI processing: Scaleway AI inference by default (EU); optionally and exclusively on request Azure OpenAI Service in the Sweden Central region (Sweden), exclusively Data Zone Standard within the EU Data Zone (EU member states, Norway and Switzerland). Scaleway is the default and is recommended.
- Security: TLS 1.3, AES-256 encryption, bcrypt hashing, JWT sessions
- No use of: profiling, automated decision-making with legal effects
6. Legal Bases
| Processing | Legal basis (Art. 6 GDPR) | Rationale |
|---|---|---|
| Platform use | 6.1.b (contract) | Service delivery |
| Educational data | 6.1.e (public interest task) | Educational purposes |
| Security logging | 6.1.f (legitimate interest) | Security |
| Statutory retention | 6.1.c (legal obligation) | Compliance |
7. Retention Periods
| Data | Retention period | Rationale | Action |
|---|---|---|---|
| Chat history | Default 90 days, customisable in consultation with the customer | User control | Automatically deleted; user can delete earlier |
| Uploaded documents | Linked to chat | Part of conversation | Deleted with chat |
| Account data | Active + 90 days | Administration | Automatically deleted |
| Security logs | Default 90 days, customisable in consultation with the customer | Incident response | Automatic rollover |
| Audit logs | Default 90 days, customisable in consultation with the customer | Accountability and incident investigation | Automatic rollover |
| Backup | 30 days rolling | Disaster recovery | Overwritten |
8. Rights of Data Subjects
| Right | Implementation | Lead time |
|---|---|---|
| Access | Export function | 5 working days |
| Rectification | Account settings | Immediate |
| Deletion | Delete function | 5 working days |
| Portability | JSON/CSV export | 5 working days |
| Objection | Assessment by privacy officer | 5 working days |
9. Risk Assessment
9.1 Identified Risks
Personal data breach
HIGH
Hack/leak of pupil or student data. Likelihood: Low, Impact: Very high
Special categories of data
HIGH
Upload of medical/care data. Likelihood: High, Impact: High
AI hallucinations
MEDIUM
Incorrect output in a teaching context. Likelihood: Medium, Impact: Medium
Unauthorised access
MEDIUM
Account compromise. Likelihood: Low, Impact: High
Vendor lock-in
LOW
Cloud provider dependency. Likelihood: High, Impact: Low
9.2 Risk Mitigation
| Risk | Technical measures | Organisational measures | Residual risk |
|---|---|---|---|
| Data breach | Encryption, TLS, access control | Incident response, training | Low |
| Special categories of data | Encryption, audit logs | Warnings, onboarding | Medium |
| AI hallucinations | Model settings | Training, disclaimers in UI | Medium |
| Unauthorised access | MFA, session timeout | Awareness training | Low |
| Vendor lock-in | Container architecture | Exit strategy 2026 | Low |
10. Special Categories of Personal Data (Article 9 GDPR)
10.1 Risk Identification
High risk: Users may upload special categories of data such as:
- • Care records
- • Medical certificates
- • Study guidance
10.2 Mitigation Measures
- Technical: Encryption of all data
- Interface: Warnings in the UI
- Training: Instruction of teachers/researchers
- Policy: No substantive analysis by EduGPT
11. Purpose Limitation and Proportionality
11.1 Permitted Purposes
✅ Only for education-related AI services
11.2 Excluded Purposes
- ❌ No product development using data
- ❌ No sale/sharing with third parties
- ❌ No marketing
11.3 Necessity and Proportionality
- Necessity: Use of AI is a reality, a secure alternative is the only option
- Proportionality: Minimal data collection, user remains in control
- Subsidiarity: Banning does not work, commercial tools are not GDPR-compliant
12. Recommendations and Implementation
12.1 Points of Attention for Educational Institutions
- Conclude a data processing agreement
- Instruct users on responsible use
- Align data breach procedures and retention periods
- Adjust internal procedures
12.2 Decision-making by the Educational Institution
- Approval of implementation
- Data processing agreement signed
- Users instructed
- Internal procedures adjusted
13. Planning and Milestones
| Milestone | Date | Status |
|---|---|---|
| DPIA finalised | September 2025 | ✅ |
| Pilot start | October 2025 | ✅ |
| Interim evaluation | November 2025 | ✅ |
| Pilot evaluation | December 2025 | ✅ |
| Go/No-go production | January 2026 | ✅ |
| DPIA update (version 2.0) | July 2026 | ✅ |
| Correction of Azure region to Sweden Central (version 2.1) | October 2026 | ✅ |
| Independent DPIA by external DPO | September 2026 | ⏳ |
| New educational implementations (school year 2026-2027) | September 2026 | ⏳ |
| DPIA review | Q4 2026 | ⏳ |
14. Legal Framework
- AVG/GDPR: Fully applicable
- Education legislation (WVO, WHW): Indirectly relevant, institutions remain ultimately responsible
- BIO 2.0: Baseline for government/education, designed in accordance, not certified
- EU AI Act: Prepared (low risk)
Annexes
- Annex A: Technical specifications (Kubernetes on Scaleway, PostgreSQL, object storage, secrets management)
- Annex B: Incident Response Plan
- Annex C: Data Processing Agreement
- Annex D: Contact details CivAI/EduGPT
Document Approval
| Position | Name | Date | Signature |
|---|---|---|---|
| Privacy Officer | |||
| CISO | |||
| Management |
This document has been prepared in accordance with the requirements of the General Data Protection Regulation (AVG/GDPR) and contains a thorough analysis of the privacy impact of EduGPT.