EdLaw
Niedersachsen — Schuldatenschutz (NSchG §§ 30–31b)
The data-protection core of the Niedersächsisches Schulgesetz: the legal basis on which Lower Saxony's public schools process pupil, parent and teacher data — and therefore the provisions that decide what a school may lawfully do with an EdTech product. Niedersachsen is the largest German Land by our subscriber base (28 of 150 mapped active subscriptions — see the TODO Germany entry), which is why it is the first Land authored. The extracted § 31 version has been in force since 1 August 2026.
Fact text is German (authentic language); this README is curation.
Applicability to EdTech
- § 31(5) is the platform gate: "Internetbasierte Lern- und Unterrichtsplattformen dürfen nur eingesetzt werden, soweit diese den Anforderungen der Datenschutz-Grundverordnung und der zu ihrer Durchführung erlassenen Rechtsvorschriften entsprechen und die Schulleitung dem Einsatz zugestimmt hat" (§ 31(5)) — an internet-based learning platform may be used only if it meets GDPR requirements and the school leadership has approved the deployment. Sentence 2 extends processing to teachers' personal data for digital teaching/learning tools. This is the provision a Niedersachsen deployment stands on.
- The purposes are enumerated: schools may process pupil/parent data only where required for the school's educational mission, care duties, education/support, school-quality research, or school supervision (§ 31(1)) — a vendor contract scoped wider than these purposes puts the school outside its legal basis.
- Surveys (Erhebungen) in schools have their own regime (§ 30) — relevant to product research and wellbeing/analysis features run through schools.
- Central school administration database (§ 31a) and the Vertrauensstelle / statistical education register (§ 31b) are the state-side data flows a product may need to coexist with.
Contents
| Document | Covers |
|---|---|
| DATENVERARBEITUNG.md | NSchG §§ 30, 31, 31a, 31b — Erhebungen, Verarbeitung, Schulverwaltungsdatenbank, Bildungsregister |
Scope note: the Niedersächsisches Datenschutzgesetz (NDSG — the Land's general data-protection act for public bodies) and ministry guidance (Bildungsportal Niedersachsen, LfD Niedersachsen school materials) can be added when needed; the school-specific legal basis lives here in the NSchG.
Key obligations at a glance
- Learning platforms: GDPR conformity + Schulleitung approval before use (§ 31(5)).
- Processing bounded to the enumerated school purposes (§ 31(1)); transmission and special-category rules in the further Absätze of § 31.
Enforcement
Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD) supervises Niedersachsen's public schools; the vendor's own processing is supervised by the Land authority of its establishment under BDSG § 40.
Related
- BDSG — the federal act governing the vendor side of the same contract
- EU GDPR — the directly applicable baseline both sides share
Sources
- NI-VORIS — NSchG § 31 (geltende Fassung)
- LfD Niedersachsen — Datenschutz in Schulen
- Bildungsportal Niedersachsen — Datenschutz an Schulen
Meta
Statute text in DATENVERARBEITUNG.md is reproduced verbatim in German from NI-VORIS and built/re-verified mechanically by tools/voris-ni/build_ni_nschg.py (verify mode; do not hand-edit statute text). VORIS pages are per-version, addressed by UUID; the pinned UUIDs were resolved as the current versions on 2026-09-06 (all sibling versions marked "alte Fassung") — re-resolve on re-verification. Sentence numbers appear as ^N; anchors derive from printed labels ({#p31-5} = § 31 Abs. 5).