The Impact of the LGPD on School Routine

The LGPD — Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018) — came into force on September 18, 2020, and brought a new perspective on how personal data should be handled by public and private organizations.

Since then, schools and educational institutions have been adapting to this new reality, seeking to understand how data protection relates to the activities that make up everyday school life.

But what has really changed inside schools with the LGPD?

LGPD: more than an obligation, a cultural shift

When we talk about the LGPD, we often think immediately of documents, policies, systems and procedures.

But data protection goes far beyond that.

The LGPD also invites us to develop a new way of thinking about the information we receive, store and share every day.

From an educational perspective, the law guides us to handle personal data with security, responsibility and ethics, seeking to reduce risks such as leaks, unauthorized access and fraud.

At school, this cultural shift is especially important because the institution deals daily with information about students, families, teachers, staff and partner companies.

What were the main changes in school routine?

The LGPD brought several points of attention to educational institutions. Among them, we can highlight:

• 1. Greater care with sensitive data — Schools work with information that requires special attention, such as data related to health, biometrics and students' specific needs. That is why it is necessary to establish appropriate controls and procedures for handling it.
• 2. Care with photos and videos — Photos and videos are part of school routine: events, learning activities, presentations, field trips and institutional communications. With the LGPD, the use and publication of these images must be part of proper governance, taking into account purpose, context, necessity and the protection of those involved.
• 3. Information security — Protecting personal data also means adopting technical and administrative measures capable of reducing risks and preventing inappropriate access or use. Information security therefore becomes part of the institution's routine.
• 4. Access control — Not everyone needs access to all information. The school must establish controls so that personal data is accessed only by authorized people and in accordance with their roles.
• 5. Management of third-party companies — Data protection does not end within the school walls. Systems, platforms, technology companies, service providers and other suppliers may handle information related to the school community. That is why it is necessary to establish greater control over third parties that have access to or carry out operations with the institution's data.
• 6. Respect for data subjects' rights — Students, parents and guardians, staff and other people whose data is handled by the institution have rights related to their personal information. The school needs to be prepared to understand these rights and to establish appropriate procedures to address them.
• 7. Governance and documentation — Compliance with the LGPD also involves organization. Policies, records, procedures, data mapping and risk management become part of a governance structure focused on protecting information.
• 8. Institutional responsibility — The school needs to understand its responsibility for the personal data it collects and uses. This means establishing practices capable of demonstrating that the institution is handling this information appropriately and responsibly.

Data protection involves the whole school

This was precisely one of the main changes brought about by the LGPD.

Data protection is no longer an exclusive concern of the technology area or the administrative department; it has become part of the school's management, governance and institutional culture.

This means that data protection needs to be present across different areas and activities.

School leadership, coordinators, teachers, administrative teams, technology, human resources and other professionals who deal with personal information all take part in this process.

The LGPD, therefore, should not be seen as the responsibility of a single person or department.

Data protection is an institutional responsibility.

Why is care even greater in schools?

Educational institutions work every day with a large amount of information, and much of it involves sensitive data, minors, health matters and aspects related to privacy.

That is why care must be redoubled.

This scenario requires continuous improvement and control over the entire data lifecycle, from collection to storage, use, sharing and disposal.

It is not a one-off action.

Data protection is an ongoing process.

The principles that guide a more conscious school

The LGPD establishes principles that help guide the proper handling of personal data.

Among them are:

Accountability, security, transparency, purpose, quality, necessity, accessibility, adequacy, prevention and non-discrimination.

These principles can be translated into very simple situations in school routine.

Before collecting a piece of information, we can ask:

Do I really need this data?

Before sharing:

Who needs to have access to this information?

Before publishing an image:

What is the purpose of this publication?

Before hiring a platform:

How does this company handle the school community's data?

These are simple questions, but they help build a culture of data protection.

LGPD is also education

A school concerned with information security and privacy is keeping pace with a new reality brought about by digital transformation.

More than complying with legislation, it is about understanding the value of personal data and the responsibility behind every piece of information.

The LGPD invites us to change the way we see data.

A name, a photograph, an address, a piece of health information, a biometric identification or any other personal data represents information about someone.

And all information about a person deserves care.

Conclusion

The LGPD brought important changes to school routine, but perhaps its main contribution lies precisely in the cultural shift.

Protecting data means caring for people.

It means understanding that security, privacy, transparency and responsibility must be part of the institution's daily decisions.

A school that develops a culture of data protection is not merely fulfilling a legal obligation.

It is building a safer, more responsible, transparent and conscious environment for the entire school community.

Because, when we talk about data protection, what we are protecting, first and foremost, are the people behind that data.

São Paulo, September 24, 2026.

Analice Ferreira

DPO | Digital Education Specialist