Skolshield

Helsinki

data centre, Finland

Germany

encrypted backups

60+

event types in the log

Article 28

a DPA with every responsible authority

Article 5(1)(f): Integrity and Confidentiality

Personal data shall be processed in a manner that ensures appropriate security.

Skolshield protects student data with:

Encrypted communication (TLS/HTTPS) for all data traffic
Encryption at rest: encrypted storage volumes and backups
Role-based access control: staff only see the students they are authorised to access
Automatic session management with inactivity timeout
Session hijacking detection, with automatic sign-out on suspected takeover

Article 5(2): Accountability

The controller shall be able to demonstrate that processing is performed in accordance with the GDPR.

Every access to student data is logged automatically. Not as an add-on: it's built into the system's architecture.

Our logging covers:

Viewing student pages and student lists
Changes to student data
File access: upload, download, deletion
Permission changes
Data exports
All logins and logouts

The audit log in Skolshield — This is what it looks like, the audit log, straight from the demo environment. Every access, with user and timestamp.

Article 25: Data Protection by Design

Data protection shall be built into the system from the start, not added afterwards.

Skolshield's security is built as layers in the platform itself (middleware) that protect and log automatically, without individual developers having to think about it. This means:

Logging cannot be forgotten
Access control cannot be bypassed
Security rules are applied consistently throughout the system
Pseudonymisation per viewer: in the limited incident view, the names of students the teacher does not teach are masked, on the server
Transfers when changing school mask other students in the same events (Student A, Student B) and require a harm assessment before export

Article 16: Right to rectification

The data subject shall have the right to obtain without undue delay the rectification of inaccurate personal data.

An erroneous or false report is annulled by school leadership with a mandatory reason. The case remains in the history, marked as annulled, is removed from statistics and overviews, and the annulment is logged. Rectification without destroying the trail. The reporter can flag an incident as filed in error.

Article 30: Records of Processing Activities

Every controller shall maintain a record of processing activities.

The Article 30 record of processing is yours, but the system supplies the material: the data processing agreement describes what data is processed and why, and the log with over 60 event types, from logins to file access and administrative changes, shows how the processing actually happens. Searchable, filterable and available to your data protection officer.

Article 32: Security of Processing

Appropriate technical and organisational measures shall be implemented to ensure a level of security appropriate to the risk.

We handle data about children, which requires heightened protection. Skolshield includes:

Intrusion detection

Automatic risk assessment of every login

Impossible travel

Flags if the same account is used from two locations within a short time

Automatic account lockout

After repeated failed login attempts

VPN and Tor detection

Unusual access methods are flagged

Mass access detection

Warning on unusually large amounts of data access

Geographic access control

Ability to restrict access by country

Article 33: Personal Data Breach Notification within 72 Hours

In the case of a personal data breach, the supervisory authority shall be notified within 72 hours.

The 72 hours count from discovery. Without detection, a breach can go on for weeks or months without you knowing.

Skolshield ensures you can meet the deadline:

Security incidents are detected automatically in real time
IT staff are notified immediately via email
A dedicated security dashboard shows all active alerts
Log data can be exported as supporting material for reporting to IMY

Article 34: Communication to the Data Subject

Where the breach is likely to result in a high risk, the data subjects shall be informed.

During a breach, Skolshield can show exactly which students' data was affected, what type of access occurred, and from where. This makes it possible to inform the right guardians with accurate information, not a generic mass notification.

Article 5(1)(e): Storage Limitation

Personal data shall not be kept longer than necessary.

Retention periods are configurable per data type, with statutory minimums built in as a floor. For municipal authorities preservation is the default, and disposal follows your records-management plan, never an automatic time limit.

Updated for the 1 August 2026 amendment (SFS 2026:1096)

Statutory chains the system models

Since 1 August 2026 new rules apply to degrading treatment (Education Act ch. 6 ss. 10–10 a): staff inform the principal about serious or repeated incidents, the principal reports them to the responsible authority, which investigates, and everything else is handled at school level. Schools must also provide student health services and document support measures. The burden of proof still rests with the responsible authority, without documentation there is no way to show the school acted correctly, whether the case stayed at school level or went further.

Rule	What the system does
Education Act ch. 6 ss. 10–10 a, degrading treatment	Grounds are stated, the principal is informed, the report to the responsible authority is logged and the investigation is followed up. Principal's acknowledgment, the authority's inbox across all school units and a daily reminder until the report is acknowledged.
Education Act ch. 3 s. 7, special support	The principal is notified when a case is opened so that an investigation is ensured. The principal's decision is documented on the case.
Student health team minutes	Minutes are approved in the system. Decisions become actions with an owner and a follow-up date.
Retention and the Archives Act	Retention floors per type of responsible authority. For municipal authorities preservation is the default; disposal only follows your records management plan.
Transfer when changing school	Other students in the same events are masked (Student A, Student B) and a harm assessment is required before export. Moves within the municipality happen automatically on sync.

See it in the system

Data Storage within the EU

All data is stored within the EU. No subprocessors outside the EU/EEA have access to student data.

No student data with US cloud services in our operations. Files are stored in your own Microsoft 365, under your existing agreement with Microsoft.

Your Data, Your Control

The responsible authority, the municipality or the independent school, is always the data controller. Skolshield is your data processor. This means:

You decide what data is processed and why

You have full visibility into all processing via the logs

You can request data export or deletion at any time

We never process data for our own purposes

The fact that data is stored with us as a managed service does not change your ownership. It's a legal status, not a hosting question.

Data Processing Agreement

We sign a data processing agreement (DPA) with every responsible authority in accordance with GDPR Article 28. The agreement specifies:

Which personal data is processed
The purpose of the processing
Technical and organisational security measures
Procedures in case of a personal data breach
Terms for subprocessors

The GDPR, article by article.