language: en · source language: de · status: in-force · last checked: 2026-10-08

Nordrhein-Westfalen — Verordnungen über die zur Verarbeitung zugelassenen Daten (VO-DV I und VO-DV II)

The operative layer under § 122(4) SchulG NRW: the two ordinances that say which data a North Rhine-Westphalian school may process, on what (official devices, networks, teachers' private devices, processors), to whom it may be transferred and for how long it is kept. VO-DV I covers pupils, parents and the persons obliged under § 41 SchulG; VO-DV II covers teachers and other school staff. Where the SchulG gives the basis for digital tools in the abstract (§ 120(5)), these ordinances are where a deployment is measured against a closed catalogue.

Ordinance text is German (authentic language); this README is curation.

Applicability to EdTech

• A closed catalogue. Schools may process only the data listed in the Anlagen; data not marked for automated processing may not be processed automatically; and anything else needs individual consent declared to the Schulleitung, which must be able to prove it (§ 1(2), § 3(2)). Derived data is covered where it is formed from catalogue data and needed for the task (§ 1(2)). A product's data model for NRW is therefore checkable line by line against Anlage 1 — which includes the pupil photo and emergency information among the items marked *), i.e. processable automatically only for the educational mandate itself, with medical reports and certificates excluded from automated processing altogether.
• Logging is a product requirement. When digital Lehr- und Lernmittel, digital communication tools or IT infrastructure are used, log data may be processed only as far as technically required for operation (§ 2(1); mirrored for staff data in VO-DV II § 2(1)). Analytics or telemetry beyond operational need is outside the ordinance. The same paragraph requires configuration that guarantees confidentiality, integrity and availability under Art. 32 GDPR and least-privilege access.
• Processors. Schools and supervisory authorities may engage "die Datensicherheit gewährleistende und zuverlässige Institutionen" under Art. 28 GDPR, on instruction and exclusively for the school's purposes (§ 2(3); VO-DV II § 3). This is the vendor's own legal position in NRW.
• Teachers' private devices need a written approval from the Schulleitung that itself contains an Art. 30 record; only the Anlage 3 data set may be held there (marks, absences, contact details, digitally created pieces of work), the approval is barred once an official personal device is issued and lapses on hand-over, and the school is controller for that processing (§ 2(2)). Data on private devices is kept for one year only (§ 9(2)). A platform that teachers reach from personal hardware sits inside this regime.
• Transfers. Data carriers sent out must be encrypted to the state of the art, a shared IT base infrastructure may be used where Art. 32 is met, and automated retrieval procedures (Abrufverfahren) are prohibited (§ 5(2)); the ministry may prescribe hardware, software and procedures for transfers (§ 5(3)). Transfers to other bodies follow § 120(7) SchulG (§ 5(1)); the school-change, compulsory-attendance and school-health transfers are itemised in §§ 6–8.
• Retention. Fifty years for duplicate leaving certificates, twenty for the Schülerstammblatt, ten for grade lists and class books, five for everything else, running from the end of the calendar year in which the file was closed and not before compulsory schooling ends (§ 9(1)); expired files are offered to the archive and otherwise destroyed or deleted (§ 9(3)).
• Staff data. VO-DV II carries the DPO arrangement for schools — Schulämter select the persons who perform Art. 39 for their district, Bezirksregierungen appoint them, or a school names its own (§ 1(6)) — and the transfers between schools, supervisory authorities, teacher-training centres, IT.NRW and the pay office (§ 8). Its eight Anlagen are the closed staff-data catalogues per body, each item keyed to the purposes it may serve: a school may hold, for example, the staff member’s official e-mail address for every purpose except the personnel reports of purposes 2a and 2b (Anlage 1 Nr. 1.15) and private contact details for teaching organisation, training and CPD, with private e-mail voluntary unless needed (Anlage 1 Nr. 1.10). A staff directory, SSO roster or teacher account in an NRW product is measured against Anlage 1.
• Trainers' private devices. The private-device regime of VO-DV II § 2(4) allows only the four-item data set of Anlage 6 — name, e-mail, the assessment of the trainee's performance and the official e-mail address; the Schulleitung's own file on each teacher records the private-device approvals given under VO-DV I § 2(2) (Anlage 2 IV Nr. 8).

Contents

Scope note: VO-DV II's Anlagen 1–8 were added on 2026-10-08 in VO-DV-II-ANLAGEN.md; each purpose matrix is rendered row by row, the marked columns listed after "Zweckbestimmung:" (see that document's Meta). The Schulministerium's Datenschutz guidance remains on demand.

Key obligations at a glance

• Process only catalogue data; consent for anything else must be provable (§ 1(2), § 3(2)).
• Log data from digital tools only as far as technically required (§ 2(1)).
• Processors under Art. 28, on instruction, for the school's purposes only (§ 2(3)).
• Encryption for data carriers; no automated retrieval interfaces (§ 5(2)).
• Retention 50/20/10/5 years; one year on private devices (§ 9).

Enforcement

Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW) supervises the schools; the Bezirksregierung is the administrative authority for the Ordnungswidrigkeiten in § 10 (failure to provide required information). The vendor's own processing answers to the Land DPA of its establishment under BDSG § 40.

Licence

The corpus reproduces the VO-DV I and VO-DV II, with their tables and footnotes, from the BASS 2026/2027 (Bereinigte Amtliche Sammlung der Schulvorschriften).

German copyright law places statutes and ordinances outside copyright. § 5 Abs. 1 Urheberrechtsgesetz (gesetze-im-internet.de — UrhG § 5, read 2026-10-01) provides: "Gesetze, Verordnungen, amtliche Erlasse und Bekanntmachungen sowie Entscheidungen und amtlich verfaßte Leitsätze zu Entscheidungen genießen keinen urheberrechtlichen Schutz."

The corpus takes the text from the BASS, the school ministry's own collection. Its Impressum (bass.schule.nrw/Home/Impressum, read 2026-10-01) names the Ministerium für Schule und Bildung des Landes Nordrhein-Westfalen as provider and contains a liability disclaimer and no terms restricting reuse. The pages carry the footer "© 2026 Ministerium für Schule und Bildung des Landes Nordrhein-Westfalen", a notice on the website that cannot create copyright in texts § 5 Abs. 1 UrhG excludes. The footnotes reproduced are the ordinances' publication and amendment references; the BASS editors' own boxes are omitted, as Meta says.

Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (the BASS). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.

Related

• SchulG NRW §§ 120–122 — the statutory basis and the ordinance power
• Sachsen VwV Schuldatenschutz — the other Land whose operative layer is extracted in full; SN restricts cloud services to EU law, NRW restricts logging and retrieval interfaces
• BDSG — the vendor-side federal act
• EU GDPR

Sources

• BASS 2026/2027 — 10-44 Nr. 2.1 VO-DV I (PDF)
• BASS 2026/2027 — 10-41 Nr. 6.1 VO-DV II (PDF)
• recht.nrw.de — SGV. NRW. 223 (primary source; JavaScript-only interface)