Statement by the President of the Personal Data Protection Office on e-School Register

Mirosław Wróblewski, President of the Personal Data Protection Office, has welcomed the initiative to create a publicly provided, state-backed digital school records system that would be free of charge for parents and pupils. Such a tool must be based on trusted solutions with a clear statutory basis. Therefore, the development of a solution analogous to the e-School Register provided for in the Act of 31 July 2026 amending the Education Law and the Act on the Education Information System (vetoed by the President of the Republic of Poland) must be preceded by an in-depth analysis of the fundamental aspects related to the legal basis for data processing and must provide appropriate cybersecurity safeguards.

There is a need for a public, free-of-charge school records service that guarantees a high level of security. Existing commercial solutions offering similar functionality often fail to provide adequate protection for personal data and raise concerns regarding compliance with GDPR principles, as demonstrated by the numerous complaints concerning such entities received by the Personal Data Protection Office. An inspection carried out at one such entity also revealed irregularities relating to the processing of personal data.

The President of the Personal Data Protection Office points out that the creation of a tool providing digital school records must be preceded by a comprehensive and transparent data protection impact assessment (DPIA), covering both the functional aspects of the IT system being developed and the legal bases for its operation. The assessment must take into account the risks associated with data centralisation and the principle of “privacy by design”, particularly with regard to the scope of data necessary for the purposes of processing. It must also clearly define the roles of the parties involved in data processing within the digital school records system. It is equally essential to provide appropriate safeguards for data security and to take into account all potential “cyber threats” that may affect pupils, their parents and teachers.

At the same time, the President of the Personal Data Protection Office wishes to emphasise that consolidating educational data in a single central database significantly increases systemic digital risk, creating a so-called “single point of failure” and exposing sensitive information concerning millions of people subject to compulsory education to large-scale security incidents. This is the most significant aspect that must be subject to a thorough and detailed data protection impact assessment (DPIA).

In the view of the President of the Personal Data Protection Office, public authorities should act as guarantors of secure data processing that serves the public interest, including for purposes such as carrying out educational tasks in relation to pupils. However, such solutions must meet the requirements for respecting the privacy of the individuals whose data will be processed within them. They should also only be put into operation following in-depth analytical work and security testing. Legislation introducing such solutions must establish high standards for the security of personal data processing and provide appropriate legal safeguards for the protection of individuals’ privacy.

As with other initiatives of this kind, the Personal Data Protection Office declares its expert support at all stages of work on implementing a free-of-charge, public digital school records system. In particular, the Office offers such support to the Ministry of National Education and the Chancellery of the President of the Republic of Poland.