The updated vademecum

From class chats to online grades: the privacy guarantor's stakes

Authoriy reminds of the rules to be respected inside and outside schools on video surveillance, electronic register, artificial intelligence, data processing

by Eugenio Bruno and Claudio Tucci

8 December 2025

Registrazione delle lezioni. È ammessa solo per motivi di studio personale o come supporto didattico per gli alunni con fragilità

4' min read

Translated by AI

Versione italiana

4' min read

Translated by AI

Versione italiana

From the introduction of artificial intelligence at school to classroom chats. From the publication of students' and teachers' personal data online to the use of smartphones. From enrolments, which will start in January, to rankings for the recruitment of teachers and technical-administrative staff. The Privacy Guarantor, in a one hundred-page document - available on the institutional website https://www.garanteprivacy.it - has updated its indications on how to deal, correctly, with issues related to the processing of personal data at school, from teaching activities to the management of labour relations, with a series of practical suggestions to help especially the youngest to protect themselves from the risks related to the development of the digital world.

Data Processing

Let us start with the general rules. Let us say right away that all schools are obliged to let the 'interested parties' (students, families, teachers and Ata staff) know how their personal data are processed, obviously within the limits of their institutional (teaching or administrative) activity. It is the school headmaster who gives indications on the point and, to access them, it is possible to address the 'data controller' also through the Data Protection Officer (DPO). If you do not get a reply, or if the response is inadequate, you can then ask the Garante or the ordinary judiciary to intervene.

Turning to concrete examples, data revealing racial and ethnic origins may be processed by the school to foster the integration of foreign pupils; similarly, data on health are important for adopting specific support measures, for home or hospital teaching, for participation in sports activities. On the other hand, when dealing with workers' information, the school must adopt technical and organisational measures to prevent its unjustified disclosure to third parties, which may be families, pupils, trade unions, etc.

Electronic and Social Register

As far as students are concerned, at the time of enrolment, schools may not request personal information that is not relevant to that purpose, such as the health status of grandparents or the profession of parents. On the other hand, it does not violate privacy if a teacher assigns his or her pupils to do classwork about their personal or family world.

The grades awarded to the student in the individual disciplines are shown in the reserved area of the electronic register; whereas admission to subsequent classes or State examinations is resolved with the words "admitted/not admitted".

Turning to the digital world, if one is a victim of hateful comments, cyberbullying, sexting, revenge porn or other interference in one's private life, one should immediately notify classmates, teachers, families. One can ask the social network operator to intervene; or contact the competent authorities. The general rule is prudence: students and other members of the school community, in any case, may not disseminate audio, photos, videos (by publishing them on the Internet) via smartphones and tablets without having first adequately informed and obtained the explicit consent of the persons involved. The creation of or participation in class chats is considered to be an activity carried out by private individuals, therefore not attributable to the school's institutional and teaching activities (in any case, privacy protection rules apply here too). As for artificial intelligence, please refer instead to the recent ministerial guidelines that have been given the green light by the Authority.

Parents should take special care if they want to share content about their children online (photos, videos, ultrasounds, stories). Video footage and photographs taken by parents during school plays, field trips and recitals do not violate privacy.

According to the Garante, it is only possible to record the lesson for personal purposes (e.g. for individual study) or if it is useful as a teaching aid for pupils with disabilities, learning disorders (Dsa) or special educational needs (Bes).

In general, the dissemination of data on class composition on the school's institutional website is not allowed, while it can take place on the electronic register or in the "physical" notice boards as long as they only show names and surnames. On the other hand, the publication of rankings (of teachers and Ata staff) is permitted: only the data strictly necessary to identify the candidate (first name, surname, position in the rankings) must be included; it is not possible to include irrelevant data, such as telephone numbers and private addresses.

Cameras at school

Coming finally to video surveillance systems, again according to the Garante, it is possible to install them to protect school buildings and property. However, filming must be restricted to the areas concerned (those subject to theft or vandalism). If the cameras are placed inside the school, they must only be activated at the end of school and extracurricular activities, and taking care to comply with regulations on remote monitoring of workers. In any case, their presence must always be indicated with appropriate signs, visible even at night.

Firm Points
General Rules

All schools have an obligation to let 'data subjects' (students, families, teachers and Ata staff) know how their personal data are processed, obviously within the limits of their institutional (teaching or administrative) activity. It is the school headmaster who gives guidance on this point and, to access it, one must contact the Data Protection Officer (DPO)

Student Life

When enrolling, schools may not ask for irrelevant personal information such as the health status of grandparents or the profession of parents. On the other hand, class topics concerning the pupils' personal or family world are allowed. The student's grades in the individual subjects are listed in the private area of the electronic register

Digital World

The general rule is prudence: students and professors may not disseminate audio, photos, videos (by publishing them on the Internet) via smartphones and tablets without having first adequately informed and obtained the explicit consent of the persons involved. The creation of or participation in class chats is considered an activity carried out by private individuals

Online publication

The dissemination of data on the composition of classes on the school's institutional website is not allowed, while it can take place on the electronic register or in the 'physical' bulletin boards as long as they only contain the pupils' names and surnames. On the other hand, the publication of rankings (of teachers and Ata staff) is allowed as long as they contain only the strictly necessary data

Video surveillance

Video surveillance systems can be installed to protect the building and school property. However, filming must be restricted to the areas concerned (those subject to theft or vandalism). In any case, their presence should always be indicated by signs, visible even at night

Claudio TucciRedattore
Luogo: Roma
Argomenti: Mercato del lavoro, education
Scheda autore
Trust project
Eugenio Brunovice caposervizio
- @Eugenio_Bruno
- LinkedIn
Luogo: Roma
Lingue parlate: Italiano, inglese, francese
Argomenti: Scuola, Università, Ricerca, Cinema, Federalismo, Enti locali
Scheda autore
Trust project