language: en · source language: de · status: in-force · last checked: 2026-09-06

Nordrhein-Westfalen — Schuldatenschutz (SchulG NRW §§ 120–122)

The data-protection core of the Schulgesetz für das Land Nordrhein-Westfalen: pupil/parent data (§ 120), staff data (§ 121) and the supplementary rules with the regulation-making power behind the VO-DV I/II ordinances (§ 122). NRW is the third-largest German Land by our subscriber base (23 of 150 mapped active subscriptions — see the TODO Germany entry).

Fact text is German (authentic language); this README is curation.

Applicability to EdTech

• § 120(5) is the digital-tools basis: schools may process pupil and parent data "für den Einsatz digitaler Lehr- und Lernmittel" where required for the school's tasks; the same applies to "Lehr- und Lernsystemen und Arbeits- und Kommunikationsplattformen einschließlich Videokonferenzsystemen", and within that frame pupils are obliged to use them (§ 120(5)) — usable without individual consent, which is the operationally decisive point for platform deployments in NRW.
• Task-necessity plus enumerated transfers: the general basis in § 120(1); duty to provide required data, other data only with voluntary consent, no disadvantage for refusal, and capable minors consenting themselves — all in § 120(2); the transfer whitelist (schools, supervision, Schulträger, health/youth authorities, …) in § 120(7).
• Tests and surveys have their own gates: standardised school-entry tests in § 120(3), other scientific studies/tests/surveys — anonymity preserved, participation voluntary, Schulleitung decides — in § 120(4).
• Teacher data mirrors the pupil rules, including the digital-tools/platform basis with mandatory use (§ 121(1)).
• § 122 carries the ordinance powers under which the operational detail lives (VO-DV I for pupil data, VO-DV II for staff data — not extracted; see scope note) (§ 122(4)).

Contents

Scope note: VO-DV I and VO-DV II (the ordinances with the concrete data catalogues and processing rules) and the Schulministerium's Datenschutz guidance are the operational layer — add them when a NRW deployment question needs the catalogue level.

Key obligations at a glance

• School processing bounded to statutory tasks; access restricted to those who need the data (§ 120(1)–(2)).
• Digital teaching/learning tools, platforms and videoconferencing covered by the express basis in § 120(5); audio/video recordings of lessons need voluntary consent (§ 120(6)).
• Consent must be voluntary and refusal must carry no disadvantage; capable minors can consent themselves (§ 120(2)).

Enforcement

Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW) supervises the schools; the vendor's own processing answers to the Land DPA of its establishment under BDSG § 40.

Related

• BDSG — the vendor-side federal act
• Niedersachsen NSchG and Bayern BayEUG — sibling Land regimes; NRW and NI both have express digital-tool clauses, Bavaria works through task-necessity plus the state IT chain
• EU GDPR

Sources

• BASS 2026/2027 — 1-1 Schulgesetz NRW
• recht.nrw.de — SGV. NRW. 223 (primary source)
• Bildungsportal NRW — Datenschutz im Schulbereich

Meta

Statute text in DATENSCHUTZ.md is reproduced verbatim in German from the BASS 2026/2027 edition (the school ministry's official collection) and built/re-verified mechanically by tools/bass-nrw/build_nrw_schulg.py (verify mode; do not hand-edit statute text). The primary SGV text on recht.nrw.de currently sits behind a JavaScript-only interface (not machine-extractable, checked 2026-09-06) — cross-check there on re-verification. BASS "(Fn N)" footnote marks are amendment apparatus and remain in the text. Anchors derive from printed labels ({#p120-5} = § 120 Abs. 5); BASS's own #1-1p120 fragments work on the live page.