Educational institutions process sensitive data about students (often minors), employees and research. AVG obligations are strict, BIO-light applies to public education, and the Wet digitale overheid sets accessibility requirements.
Student data requires parental consent for minors, strict retention limits and a functioning DPA structure. Research data often crosses borders — complex data transfer rules apply. Ransomware incidents in education have surged 300% since 2022.