[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-article-gdpr-for-international-online-school":3},{"uuid":4,"title":5,"subtitle":6,"content":7,"preview":286,"date_published":287,"date_pinned":287,"img":288,"alias":289,"is_published":290,"is_pinned":291,"type":13,"category":292,"category_name":293,"category_alias":294,"background_color":295,"preview_icon":13,"category_value":296,"external_link":13},"a6bdd578-85c8-4259-a2f6-865ec55ad81b","What Is the GDPR, and When Does It Apply to an International Online School?","How to assess whether European rules apply to an online school's operations. We examine processing purposes, lawful bases, transparency, and data minimization.",{"type":8,"content":9},"doc",[10,18,20,25,27,37,39,44,46,51,53,55,63,68,70,75,77,82,84,86,92,97,99,104,106,111,112,120,122,127,128,133,135,140,142,144,150,155,157,162,164,166,172,177,179,184,186,192,197,198,203,204,209,210,215,216,221,222,227,228,233,234,239,240,245,247,249,255,260,262,267,269,274,276,278,285],{"type":11,"attrs":12,"content":14},"paragraph",{"align":13},null,[15],{"text":16,"type":17},"At WeStudy, preparation for working with an EU audience should begin with a data map, lawful bases, and routes for handling user requests.","text",{"type":11,"attrs":19},{"align":13},{"type":11,"attrs":21,"content":22},{"align":13},[23],{"text":24,"type":17},"A student registering from Europe does not, by itself, provide a universal answer about the GDPR.",{"type":11,"attrs":26},{"align":13},{"type":11,"attrs":28,"content":29},{"align":13},[30,35],{"text":31,"type":17,"marks":32},"The GDPR (General Data Protection Regulation)",[33],{"type":34},"strong",{"text":36,"type":17}," is the European Union's main law on protecting personal data and people's privacy. ",{"type":11,"attrs":38},{"align":13},{"type":11,"attrs":40,"content":41},{"align":13},[42],{"text":43,"type":17},"Relevant factors include the place of establishment, targeting services at people in the EU, and monitoring their behavior. If a school has a European version of its website, accepts the relevant currency, advertises in specific countries, or systematically serves their audiences, it should assess territorial applicability with a lawyer.",{"type":11,"attrs":45},{"align":13},{"type":11,"attrs":47,"content":48},{"align":13},[49],{"text":50,"type":17},"The GDPR is built around lawfulness, transparency, purpose limitation, minimization, accuracy, storage limitation, and security. It involves more than a cookie banner. A school should know which data passes through its CRM, LMS, payment services, video platforms, analytics, and mailing systems.",{"type":11,"attrs":52},{"align":13},{"type":11,"attrs":54},{"align":13},{"type":56,"attrs":57,"content":60},"heading",{"align":13,"level":58,"id":59},2,"heading_2_1",[61],{"text":62,"type":17},"Roles and Lawful Bases",{"type":11,"attrs":64,"content":65},{"align":13},[66],{"text":67,"type":17},"Determine where the school is a controller and where a provider acts as a processor. Check service agreements, the terms for international data transfers, and the location of infrastructure. ",{"type":11,"attrs":69},{"align":13},{"type":11,"attrs":71,"content":72},{"align":13},[73],{"text":74,"type":17},"Each purpose needs an appropriate lawful basis: performance of a contract, legitimate interests, a legal obligation, or consent. Do not automatically use consent for everything.",{"type":11,"attrs":76},{"align":13},{"type":11,"attrs":78,"content":79},{"align":13},[80],{"text":81,"type":17},"Give users a clear processing notice. Organize separate procedures for requests for access, rectification, erasure, restriction, and data portability. A response should not depend on whether an employee remembers which five services hold the profile.",{"type":11,"attrs":83},{"align":13},{"type":11,"attrs":85},{"align":13},{"type":56,"attrs":87,"content":89},{"align":13,"level":58,"id":88},"heading_2_2",[90],{"text":91,"type":17},"Privacy as a Process",{"type":11,"attrs":93,"content":94},{"align":13},[95],{"text":96,"type":17},"Introduce processing records, an access matrix, deletion periods, and provider assessments. High-risk scenarios may require a data protection impact assessment. Pay particular attention to profiling, proctoring, biometrics, and decisions that significantly affect a person.",{"type":11,"attrs":98},{"align":13},{"type":11,"attrs":100,"content":101},{"align":13},[102],{"text":103,"type":17},"The GDPR does not require collecting documents for their own sake. Its logic is to demonstrate that the school understands the risks and can explain its decisions.",{"type":11,"attrs":105},{"align":13},{"type":11,"attrs":107,"content":108},{"align":13},[109],{"text":110,"type":17},"Official source: ",{"type":11},{"type":11,"attrs":113,"content":114},{"align":13},[115],{"text":116,"type":17,"marks":117},"EU Regulation 2016\u002F679 (GDPR)](https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng).",[118],{"type":119},"em",{"type":11,"attrs":121},{"align":13},{"type":11,"attrs":123,"content":124},{"align":13},[125],{"text":126,"type":17}," How to Avoid Treating the GDPR as a 'Law for the Whole World'",{"type":11},{"type":11,"attrs":129,"content":130},{"align":13},[131],{"text":132,"type":17},"The GDPR is EU law rather than a universal global code. However, its principles are useful as a high internal standard. ",{"type":11,"attrs":134},{"align":13},{"type":11,"attrs":136,"content":137},{"align":13},[138],{"text":139,"type":17},"Prepare a legal overview for every new country: territorial applicability, local representation, and rules on cookies, marketing, children's data, and cross-border transfers. Ukraine, the United Kingdom, Canada, the United States, and other markets have their own regimes, which should not mechanically be replaced by the GDPR.",{"type":11,"attrs":141},{"align":13},{"type":11,"attrs":143},{"align":13},{"type":56,"attrs":145,"content":147},{"align":13,"level":58,"id":146},"heading_2_3",[148],{"text":149,"type":17},"Example of Assessing an International Launch",{"type":11,"attrs":151,"content":152},{"align":13},[153],{"text":154,"type":17},"A school translates its website into German, sets prices in euros, and advertises to residents of Germany. These are much stronger indications of targeting the EU than an incidental purchase by someone temporarily in Europe. The team should document its assessment of territorial applicability, define provider roles, and check data transfer mechanisms.",{"type":11,"attrs":156},{"align":13},{"type":11,"attrs":158,"content":159},{"align":13},[160],{"text":161,"type":17},"Do not limit the audit to the registration page. Cookies, advertising pixels, behavior recordings, support chat, and videoconferencing may also process personal data. A banner offering only an 'Accept' button does not establish the lawfulness of the entire process.",{"type":11,"attrs":163},{"align":13},{"type":11,"attrs":165},{"align":13},{"type":56,"attrs":167,"content":169},{"align":13,"level":58,"id":168},"heading_2_4",[170],{"text":171,"type":17},"An Implementation Plan without Unnecessary Bureaucracy",{"type":11,"attrs":173,"content":174},{"align":13},[175],{"text":176,"type":17},"Start with a data map and a provider list. Then establish lawful bases, prepare clear notices, and create a user request procedure. Next, set deletion periods and incident response rules, and train the team.",{"type":11,"attrs":178},{"align":13},{"type":11,"attrs":180,"content":181},{"align":13},[182],{"text":183,"type":17},"Check analytics involving minors, automated profiling, and assessment separately. If a system's result affects admission, certification, or access to an opportunity, greater transparency and human review are needed. Documentation should reflect actual practice rather than an idealized picture.",{"type":11,"attrs":185},{"align":13},{"type":56,"attrs":187,"content":189},{"align":13,"level":58,"id":188},"heading_2_5",[190],{"text":191,"type":17}," Signs of Readiness to Work with the EU",{"type":11,"attrs":193,"content":194},{"align":13},[195],{"text":196,"type":17},"Before launch, the team should be able to:",{"type":11},{"type":11,"attrs":199,"content":200},{"align":13},[201],{"text":202,"type":17},"- explain why the GDPR does or does not apply;",{"type":11},{"type":11,"attrs":205,"content":206},{"align":13},[207],{"text":208,"type":17},"- identify the controller and main processors;",{"type":11},{"type":11,"attrs":211,"content":212},{"align":13},[213],{"text":214,"type":17},"- show a register of purposes and lawful bases;",{"type":11},{"type":11,"attrs":217,"content":218},{"align":13},[219],{"text":220,"type":17},"- locate one user's data across all services;",{"type":11},{"type":11,"attrs":223,"content":224},{"align":13},[225],{"text":226,"type":17},"- fulfill a request within the required period;",{"type":11},{"type":11,"attrs":229,"content":230},{"align":13},[231],{"text":232,"type":17},"- justify transfers outside the relevant territory;",{"type":11},{"type":11,"attrs":235,"content":236},{"align":13},[237],{"text":238,"type":17},"- report an incident to the responsible person.",{"type":11},{"type":11,"attrs":241,"content":242},{"align":13},[243],{"text":244,"type":17},"Do not use this list as a certificate of compliance. For example, appointing a representative or DPO, or conducting an impact assessment, depends on the circumstances. Repeat the assessment after changes to analytics, payment services, advertising countries, or AI models, because the previous conclusion may no longer reflect the actual process.",{"type":11,"attrs":246},{"align":13},{"type":11,"attrs":248},{"align":13},{"type":56,"attrs":250,"content":252},{"align":13,"level":58,"id":251},"heading_2_6",[253],{"text":254,"type":17}," Next Step",{"type":11,"attrs":256,"content":257},{"align":13},[258],{"text":259,"type":17},"Create a one-page overview of entry into the EU market: target countries, languages, advertising channels, providers, data types, and international transfers. Give it to a consultant together with an actual diagram of the services rather than only the privacy policy text. Incorporate the resulting decisions into an operational plan with responsible people so that the GDPR does not remain an isolated legal project.",{"type":11,"attrs":261},{"align":13},{"type":11,"attrs":263,"content":264},{"align":13},[265],{"text":266,"type":17},"Set a reassessment date after launch, when actual information about the audience, providers, and advertising technologies becomes available. Test the initial conclusion in practice rather than retaining it indefinitely.",{"type":11,"attrs":268},{"align":13},{"type":11,"attrs":270,"content":271},{"align":13},[272],{"text":273,"type":17},"Before an international launch, review WeStudy settings together with your own forms, mailing systems, and integrations as one data processing chain.",{"type":11,"attrs":275},{"align":13},{"type":11,"attrs":277},{"align":13},{"type":11,"attrs":279,"content":280},{"align":13},[281],{"text":282,"type":17,"marks":283},"This material is for information purposes and does not replace individual legal advice.",[284],{"type":119},{"type":11},[],1787952628,"https:\u002F\u002Fcloud.cs2.westudy.ua\u002Ffile?path=westudy_online\u002Fpublic\u002Fwestudy\u002Fa4b6ba3e-b540-4da8-92c4-5bbeaa3c47c9.webp","gdpr-for-international-online-school",true,false,"c0445ad7-3b4f-4879-97d1-f41146d093fb","Право та етика","law-and-ethics","light","news.articles"]