In today’s world, having a website is virtually standard for any educational institution. A school website serves multiple functions: providing information, facilitating communication with students and parents, promoting the institution’s activities, and showcasing student achievements. In many cases, the school’s website acts as a digital chronicle, storing past photos and articles. However, publishing such materials requires careful review. This raises an important question: how long can student data be published on a school website? Below, we provide some answers.
To begin with, it’s important to note that the law does not specify a fixed period for which student data (especially images) can be published online. This means the school must interpret the rules itself based on the principles outlined in the GDPR. Above all, two conditions must be met: there must be a valid legal basis for processing the data, and the school must adhere to the principle of data minimization and storage limitation.
1. Legal Basis for Processing
Publishing a student’s image is only permissible after obtaining consent from their parents (or from the student directly, if they are of legal age). Consent is the most appropriate legal basis in this case because maintaining a school website and publishing materials on it is not a statutory duty of the educational institution. In other words, the law neither requires nor prohibits a school from having a website. Therefore, schools cannot rely on legal obligation or public interest as a basis for publishing student data (although the situation may differ in the case of teaching staff).
2. Data Retention Limitation
Personal data must be stored in a form that allows identification of the data subject no longer than necessary for the purposes for which the data is processed.
If the school collects consent for publishing students’ images when they enroll, the assumption should be that this consent is valid until withdrawn — but only for as long as it is necessary to fulfill the original purpose, such as posting about current school events. When a student graduates, the school should reassess whether continued publication still serves its stated purpose.
Frequently Asked Questions
Can student data be published online indefinitely?
No. At the time consent is collected, the school should define how long the data will be used. For instance, it may decide internally that the “News” or “Gallery” sections will not display posts older than 3–4 years. This doesn’t need to be formalized (e.g., via a principal’s directive), but everyone managing the website should follow the same rules.
Our school has a long-standing tradition of highlighting student achievements — some pages about athletes or academic winners date back 8–10 years. Do we now have to delete that section?
It depends. If the school did not obtain proper consent prior to GDPR enforcement (i.e., before 25 May 2018), there are two options:
(1) Contact alumni to request consent for continued publication, or
(2) if that’s not possible, remove their data.
Data cannot be processed without a valid legal basis — meaning the school cannot publish names or images of students without appropriate consent.
We’d like to start a new section for outstanding student achievements, beginning with the GDPR era. Is general consent collected during enrollment enough to keep publishing this information for 5–10 years?
We recommend collecting separate consent from students for this purpose.
Creating a dedicated section or list of outstanding students constitutes a new processing purpose — no longer short-term event reporting, but long-term promotion of the school’s values, achievements, and educational quality.
Therefore, students (or their parents) must be clearly informed about how their data will be used, and for how long.