In short: Individual learning plans often contain information that counts as health data, one of the special categories of personal data under Art. 9 of the GDPR. The school is the controller, and in Germany the detailed rules, for example on private devices, are set by each federal state. A few principles help in everyday work: only write down what the support requires, work on approved devices and services, store data encrypted, share selectively and respect retention periods. This article is not legal advice.

An evening at the kitchen table, a made-up but typical scene: a teacher finishes the learning plans for her class. The laptop is her own, the template arrived by email from a colleague, and she clears up a question about a diagnosis quickly via a messaging app. None of this is ill-intended. But this document holds some of the most sensitive data a school processes at all.

We wrote earlier about how to keep learning plans short and measurable. This article is about the other side: what may go into a plan, and where may it be kept?

Why are learning plans so sensitive?

Under the General Data Protection Regulation, health data means personal data related to a person’s physical or mental health which reveals information about their health status (Art. 4(15) GDPR). This covers past, current and future health status (Recital 35).

Such information easily finds its way into learning plans: a diagnosis such as ADHD or autism, a medical report, a visual or hearing impairment, therapy, medication. Observations about emotional wellbeing may also count, depending on what they say. Whether a given entry contains health data depends on the case. But for many learning plans it is the rule rather than the exception.

For these “special categories”, processing is prohibited in principle, with exceptions (Art. 9(1) and (2) GDPR). Schools may process such data if a law allows it and provides suitable safeguards. In Germany, those laws are the school acts and regulations of the federal states. The GDPR also stresses that children’s data merit specific protection (Recital 38).

Graphic: Outline of a learning plan with placeholders. Fields that can be especially sensitive are highlighted: diagnoses, medical reports, therapies, medication and observations about emotional wellbeing. Less sensitive: learning goals, interventions and dates. Note: what the support does not need does not belong in the plan.

Who is responsible, and what do the states regulate?

Under the GDPR, the controller is usually the school, represented by the head teacher, not the individual teacher. What exactly is allowed is set by the German states, and they differ. Two examples:

  • North Rhine-Westphalia: teachers who want to process pupil data on a private device need written approval from the head teacher. An annex to the regulation lists which data are allowed. Teachers who have been issued a work device cannot get approval for a private one (§ 2(2) VO-DV I).
  • Bavaria: private devices that store personal data for work purposes must be reported to the school before first use. The head teacher decides whether and which applications are allowed, and minimum security standards apply (Bavarian Ministry of Education, as of May 2025).

So whether learning plans may be edited on a private device in your state or country cannot be answered in general. The right person to ask is your school’s data protection officer.

Which principles always apply?

Whatever the local rules, the GDPR principles apply (Art. 5):

  • Purpose limitation: data in a learning plan serve the support, not other purposes.
  • Data minimisation: only as much as the purpose requires.
  • Storage limitation: not kept longer than necessary; retention periods are set locally.
  • Integrity and confidentiality: appropriately protected against unauthorised access and loss.

Two further duties matter especially when choosing software: data protection by design and by default (Art. 25) and security of processing, explicitly including encryption (Art. 32). Large-scale processing of special categories may require a data protection impact assessment (Art. 35). Whether that applies to a particular program at your school is for the school to decide, not the individual teacher.

What you can do

Graphic: Where does the learning plan live? Less suitable: private cloud, messaging apps, private email, unencrypted USB stick, printout left on a desk. More suitable, within your local rules: work device or approved private device, encrypted storage, the school’s platform, printout in a locked cupboard.

  1. Only write what matters for support. Instead of “Diagnosis: …, medication: …” it is often enough to note what helps in class: “needs a movement break after 15 minutes”. Diagnoses and medical reports belong in the pupil file, not in every copy of the plan.
  2. Ask what is allowed. Check with the head teacher or the data protection officer which devices and programs you may use, and get any approvals you need.
  3. No messaging apps, no private cloud. Learning plans do not belong in chats, private inboxes or cloud storage without a contract with the school.
  4. Encrypted and locked. Device with a passcode, data encrypted, screen locked whenever you step away.
  5. Share selectively. A teaching assistant may need one goal and the matching intervention, not the whole plan. Pass on only what a person needs for their role.
  6. Don’t forget paper. A printout can be read by anyone who picks it up. It belongs in a locked cupboard, not an open pigeonhole in the staff room.
  7. Know the retention periods. Ask how long plans are kept and when copies must be deleted, and delete private copies once you no longer teach the child.

What we are working on

We are working on a tool for learning plans, and data protection is not an add-on but the foundation. We have made three decisions:

  • Local, not cloud. Plans live only on the teacher’s device. There is no account and no server that plans are sent to. We as the provider never receive learning plans.
  • Encrypted on the device. Stored data are encrypted with a key that is only released by the teacher’s own PIN or password (AES-256-GCM, key derivation with Argon2id). Without the PIN, even a copy of the database cannot be read. After a few minutes without use, the tool locks itself.
  • Share selectively. A plan or individual goals can be passed on as an encrypted code instead of a file attached to an email.

We are open about two limits: a printout is as readable as any other piece of paper. And technology does not replace approval: whether a school may use such a tool is for the school to decide under its local rules. The tool has not been released yet, and we are not giving a date.

Frequently asked questions

May I write learning plans at home on my own laptop? That depends on your state or country and your school. Some German states require approval from the head teacher, and not all data are allowed on private devices. Ask your school’s data protection officer.

Is a learning plan always a document with health data? Not automatically. A plan with reading goals and interventions may contain none. As soon as it includes diagnoses, therapies, medication or information about health status, Art. 9 GDPR applies.

Do we need parental consent? That varies; some states rely on statutory provisions, others on consent. We cannot and will not give a general answer here.

Is a password on the document enough? A password is better than none, but it does not replace a protected device, secure storage and clear rules for sharing. Which measures are appropriate is for the school to assess under Art. 32 GDPR.

Sources

Lernwunder editorial team · Chaolan Lu

Вернуться в блог