New national DPIA for the use of Google Workspace for Education in Norwegian Schools

As digital tools are implemented in schools, it is the responsibility of the municipality, as the school owner, to safeguard the privacy of students. Many municipalities invest considerable time and resources in conducting DPIAs. KS, in a national project, has developed a joint DPIA for the use of Google Workspace for Education in collaboration with five municipalities and county councils.

On this page, you will find the DPIA along with links to numerous resources that we have created as part of the project.

Know someone who doesn’t want to delve into the DPIA but still wants a brief summary of the conclusions? Send them to this article where we've provided a short summary of the main recommendation and a simple explanation. Read the summary here.

80-20 Percent Approach and Step-by-Step Guide

We have published a DPIA that is 80 percent complete. Assuming that municipalities fulfill their obligations, which we facilitate, Norwegian municipalities are now well-equipped to use the core services of Google Workspace For Education in a more privacy-friendly manner.

Now that the DPIA is published, the goal is for the municipalities themselves to take ownership of the DPIA, adjust the assessment according to their own needs, and fulfill their role as data controllers. Meanwhile, municipalities do not have to start from scratch. School owners can take the DPIA from 80 to 100 percent.

How should you know what the last 20 percent consists of and what do you need to adjust yourself? In the DPIA itself, we have marked yellow fields where we believe you need to fill in and adjust.

We have also created a step-by-step guide to help you determine what you specifically need to address. Read the guide here.

Download the DPIA

• DPIA Main Document with attachments [Word document in English]
• DPIA Data Protection Impact Assessment [Excel document in English]

In the DPIA, we ask you to use a record of processing as a part of the systematic description of processing activities (part 1 of a DPIA). You can find our proposal for a record of processing in Norwegian here: Record of processing for Google Workspace for Education.

One-on-One Guidance on Webinar

In this project, we wanted to do guidance differently. Therefore, you won’t receive a lengthy PDF on how to fill out the DPIA. Instead, we prefer to provide one-on-one guidance through webinars, with recordings available so others can also learn. We believe we learn best together, and if you are struggling with an issue, it’s guaranteed that others are too.

Need guidance on filling out the DPIA? View one of our previous guidance sessions in Norwegian here or reach out to the project manager ida.thorsrud@ks.no if you have further questions.

Introductory videos on privacy

Are you completely new to privacy, have never worked with it before, and are now taking this DPIA from 80 to 100 percent? Check out these video lessons that provide a short and manageable introduction to the field.

While working on the DPIA, we discovered some particularly relevant issues that we felt needed to help school owners with. We have created separate guides for these in Norwegian, which you can find below:

• What is the primary legal basis Norwegian school owners (municipalities) can use for the processing of personal data in a solution such as Google Workspace for Education? 
• Google Workspace for Education is a service that is continously being developped and changed. How can Norwegian municipalities manage such changes? 
• It can be challenging for school owners to handle requests where the data subject make use og their right to protest since the processing is based in the Norwegian Education Act. We have made a guideline on how to approach such protests. 

Transfers of Personal Data to Third Countries

If you use the simplest licenses of Google Workspace for Education, you will be able to transfer personal data to third countries. View the third-country assessments we have published and the method we use here.

More resources and launch seminar in January

We will have a launch seminar for the national DPIA on Thursday, January 30, 2025, from 9:00 AM to 12:00 PM at KS in Oslo. This event will also be streamed for those who cannot attend in person. Save the date. More information about this will come in our January newsletter.

Until this seminar, we will also be able to adjust this page or the DPIA if we find something that needs to be corrected. We will document changes in the DPIA in a change log (see the table at the very beginning of the DPIA). We may also add more resources that we link to here on this page.

Subscribe to our newsletter

Would you like to receive updates about the national DPIA project, this guide, and other activities that we at SkoleSec do? Subscribe to our newsletter here.