A New Perspective on Data in Educational Institutions

Have you ever stopped to think about how much data a school handles every day?

Every day, an educational institution receives, collects, stores and uses a large amount of information.

This includes data about students, former students, families, staff, suppliers and outsourced companies.

Each piece of this information serves a purpose within the school routine.

But there is one question that needs to be present in all of these activities:

Why are we processing this data, and what will it be used for?

Legal basis and purpose: two essential questions

The Brazilian General Data Protection Law (LGPD) introduced a new way of looking at the processing of personal data.

Put simply, we can understand it this way:

• Legal basis = why are we legally allowed to process this data?
• Purpose = what do we need this data for?

These two questions help the school understand whether the processing is truly appropriate and whether that information is necessary for a given activity.

It is not enough to collect a piece of information because it "has always been requested".

It is necessary to understand what the need is, what the purpose is and how this data will be protected.

Not all data is the same

One of the great challenges for educational institutions lies precisely in the diversity of information that is part of the school routine.

And some data requires even greater care.

This includes information related to health, biometrics, disabilities, racial or ethnic origin and other information that may pose greater risks to data subjects.

We may find, for example:

• Medical records and reports;
• Information about allergies and medications;
• Data related to disabilities;
• Facial recognition and biometrics;
• Information about racial or ethnic origin;
• Health information about employees;
• Genetic data, when eventually processed.

Sensitive personal data receives special protection under the LGPD because its processing may involve greater risks of discrimination or violation of rights.

When it comes to children and adolescents, care must be even greater

Schools deal with information about children and adolescents every day.

For this reason, data protection must be associated with full protection, privacy, security and the best interests of this group.

This scenario gained new guidelines with the Digital Statute of Children and Adolescents (ECA Digital — Brazilian Law No. 15,211/2025), which reinforces the protection of children and adolescents in the digital environment.

In practice, the school needs to seek a balance between its activities and four fundamental points:

• 1. Legal compliance.
• 2. Privacy.
• 3. Security.
• 4. The best interests of the child and the adolescent.

And when the school uses images?

Photos and videos are part of the school routine.

Events, teaching activities, campaigns, presentations and projects may involve capturing images.

But before using or publishing an image, it is important to consider:

• What is the purpose?
• Where will this image be published?
• Who will be able to see it?
• How long will it be stored?
• Will it be shared with third parties?

These decisions should not be made in isolation.

The school can involve different areas, such as the DPO, Marketing, Pedagogical Management, Legal and IT, to assess the purpose of capturing images, the means of publication, the audience that will have access, the storage period and the risks involved.

Photography and biometrics are not the same thing

This is an important point.

A photograph of a child or adolescent is not automatically sensitive personal data simply because it is a photograph.

The situation is different when there is facial recognition or biometric processing, since biometric data is classified by the LGPD as sensitive personal data.

This distinction is important so that the school can develop image use policies that are correct and appropriate to the reality of each type of processing.

Image use authorization: the clearer, the better

Another important point is the way the school presents the authorization for the use of images of children and adolescents.

The authorization must state the purpose of the processing in a clear, specific and prominent way, avoiding generic authorizations.

It is important to make clear, for example:

• What the image will be used for;
• Where it will be published: website, social media, teaching materials, events, campaigns, etc.;
• How it will be used: photography, video, institutional communication or advertising material;
• Who will have access to it;
• How long it will be stored;
• Whether it may be shared with third parties;
• What the data subject's rights are;
• Which institution is responsible for the processing;
• What the contact channel for data protection is;
• When applicable, how withdrawal of consent works.

Authorization is not a blank check

One of the most important precautions is to avoid a broad and unrestricted authorization for any future use of the image.

The school must define the purposes and use the image in a way that is consistent with what was disclosed.

This means that transparency is also a form of protection.

By clearly explaining how an image will be used, the institution strengthens trust with students, families and the entire school community.

Data protection must be part of the school culture

The LGPD introduced a new way of looking at information.

We are not talking only about documents, systems or rules.

We are talking about people.

Behind every piece of data there is a data subject who deserves respect, security and protection.

For this reason, LGPD compliance should not be seen as a project that ends when the documents are created.

It is an ongoing process of awareness, prevention and changing habits.

Conclusion

The LGPD came to transform the way we deal with information.

In educational institutions, this transformation is even more important because it involves data about many different people and, often, information related to children and adolescents.

That is why we need to develop a new perspective.

• Before collecting, ask: Is it really necessary?
• Before using: What is the purpose?
• Before sharing: Who needs to have access?
• Before publishing an image: Are we protecting the rights and best interests of the child or adolescent?

Data protection begins with simple questions and responsible choices.

The LGPD may establish rules, but it is cultural change that turns those rules into habits.

And a school that learns to take care of data is, above all, learning to take care of people.