EdLaw
Nordrhein-Westfalen — Datenschutzgesetz Nordrhein-Westfalen (DSG NRW)
North Rhine-Westphalia's general data-protection act for public bodies, supplementing the GDPR wherever the school-specific rules of the SchulG NRW and the VO-DV I/II do not answer the question (special provisions take precedence, but the Act fills any gap they leave — § 5(6)). It names schools expressly: municipal schools count as public bodies when they process personal data in internal school matters (§ 5(1)). This instrument carries Teile 1 and 2 as far as they reach a school or its processor; Teil 3 (law-enforcement processing under Directive 2016/680) is not carried. Text in the version valid from 1 April 2026 (as amended by Article 3 of the Act of 18 November 2025, GV. NRW. S. 988).
Statute text is German (authentic language); this README is curation.
Applicability to EdTech
- Schools are public bodies. Teil 2 applies to the Land's authorities, institutions and other public bodies, the municipalities and the public-law bodies under Land supervision; municipal schools processing personal data in internal school matters are public bodies within the Act, and a private body exercising sovereign tasks of a Land body counts as one (§ 5(1)). The Land's bodies must each ensure GDPR and Act compliance in their area (§ 2).
- Legal basis and data separation. Processing is lawful where necessary for a public-interest task or in the exercise of official authority (§ 3(1)); processing should be organised so that data can be separated by purpose and by data subject (§ 3(2)) — a design requirement for any multi-purpose platform.
- Automated retrieval needs a legal basis. Automated procedures through which other public bodies retrieve stored data are lawful only for Art. 6(1)(c) or (e) GDPR purposes and where a legal provision permits them (§ 6(1)); the same rules apply within a single public body and to regular transfers (§ 6(4), § 6(5)). Read with the VO-DV I ban on automated retrieval procedures for school data (VO-DV I § 5(2)).
- Safeguards that bind processors' access. Where special-category data is processed, the controller must take appropriate and specific measures, among them after-the-fact auditability of input, change and deletion, restricting access within the controller and at processors, pseudonymisation, encryption and resilience (§ 15).
- DPIA by the ministry. A DPIA should not be repeated where the competent supreme Land authority has already carried one out for processing taken over essentially unchanged (§ 24(1)); a public body developing a procedure for use by public bodies may do the DPIA for all (§ 24(3)).
- Video surveillance of publicly accessible areas only for domestic authority, protection of life, health and property, or access control (§ 20(1)); signposted with the Art. 13(1)(a)–(c) information at the earliest point (§ 20(2)); data deleted without delay unless needed for the listed purposes (§ 20(4)).
- Sanctions. GDPR fines may be imposed only on the public enterprises listed in § 5(5) Nr. 1–4 (§ 32) — not on schools; the offence of unauthorised processing or re-identification of protected non-public data (fine up to EUR 50,000, § 33(1)–(2)) is not applied to public bodies (§ 33(4)) but reaches individuals, including a processor's staff; for payment or with intent to enrich or harm it is a crime (§ 34).
- Not in Teile 1–2: no provision on processing on behalf (Art. 28 GDPR applies directly; § 52 "Verarbeitung personenbezogener Daten im Auftrag" is in Teil 3, the law-enforcement part) and no provision on a consent age or on children.
Contents
| Document | Covers |
|---|---|
| DSG-NRW.md | DSG NRW §§ 1–6, 8, 9, 15, 16, 18, 20, 24, 32–34 in full |
Key obligations at a glance
- Municipal schools are public bodies in internal school matters (§ 5(1)).
- Data separable by purpose and data subject (§ 3(2)).
- Automated retrieval only with a legal basis (§ 6(1)).
- Special-category safeguards including access limits at processors (§ 15).
- No GDPR fines against schools (§ 32).
Enforcement
The Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW) supervises the public bodies (§§ 25–28 DSG NRW, not carried) and is the administrative authority for the offences (§ 33(3)). The vendor's own processing as a non-public body answers to the DPA of its establishment under BDSG § 40.
Licence
The corpus reproduces sixteen sections of the Datenschutzgesetz Nordrhein-Westfalen from RECHT.NRW.DE, the Land's official portal.
German copyright law places statutes and ordinances outside copyright. § 5 Abs. 1 Urheberrechtsgesetz (gesetze-im-internet.de — UrhG § 5, read 2026-10-01) provides: "Gesetze, Verordnungen, amtliche Erlasse und Bekanntmachungen sowie Entscheidungen und amtlich verfaßte Leitsätze zu Entscheidungen genießen keinen urheberrechtlichen Schutz."
The Impressum of RECHT.NRW.DE (recht.nrw.de/impressum, read 2026-10-08) names the Ministerium des Innern des Landes Nordrhein-Westfalen (Redaktion der Verkündungsblätter) as provider and contains a liability disclaimer and no terms restricting reuse; the footer reads "© 2026 Ministerium des Innern des Landes Nordrhein-Westfalen", a notice that cannot create copyright in texts § 5 Abs. 1 UrhG excludes.
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: the fact document names its source in each section's citation line and in its Meta section, and Sources here links the official text. The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.
Related
- SchulG NRW Datenschutz — the school-specific legal basis (§§ 120–122 SchulG)
- VO-DV I/II NRW — the closed data catalogues for pupils and staff
- BDSG — the federal act for the vendor's own processing
- EU GDPR