ISH Academy / Innovate / GDPR Check / Evidence
CompassionateSource map and reviewer notes
Evidence and school review
Where each answer of the GDPR Check comes from, what changed in October, and what the school still has to confirm.
Release status: a guide, not an approval
The GDPR Check is a discussion and referral tool. Since 6 October 2026 it says “Go ahead” in two cases only: nobody can be identified from the material (sharing work, a photo or a file; not apps or AI), and a use or workflow the school set up or confirmed, after the sharing checks. A system being available at ISH is not enough. Every other route ends in “check before acting” or a stop/report instruction. For an app or an AI tool it looks up the foundation’s application register, one app at a time (see the source map); it cannot verify a staff member’s answers. Everyday staff tool, listed on the ISH Academy Innovate page since 6 October 2026.
The Privacy Officer’s comments. The changes of 6 October 2026 follow comments from Julie van Riemsdijk, Privacy Officer: a go-ahead only for a confirmed use or workflow, ICT first for new apps, AI tools and new uses, check first when something is unclear, and her contact details. The guide cannot cover every situation, and nothing on these pages claims school approval.
Still to confirm: the app request form, the media-permission process and the AI policy appendix wording. This is a proposed release check for this tool, not a claim that GDPR legally requires a privacy officer to approve every routine action.
Changes since 1 October 2026
| What | Before | Now | Source |
|---|---|---|---|
| Look | Pale page, small text, a small answer label | ISH Blue band with the guide’s curve, icons, larger text, a clear answer block, your answers shown as you go | ISH Style Guide 2026; AI Use Check |
| Privacy contact | “School privacy coordinator” and a shared mailbox | Julie van Riemsdijk, Privacy Officer, with her school address; the intranet mailbox stays as an alternative for incidents | GDPR for Teachers deck |
| Something has gone wrong | Report to on-site ICT and the coordinator | Tell on-site ICT straight away, then contact Julie for privacy guidance | GDPR for Teachers deck |
| New app or tool | Ask ICT or the coordinator | Check with ICT first; a new tool or a new use of personal data goes to Julie; a short note on what gets checked (who manages the accounts) | GDPR for Teachers deck; EDPB |
| Requests about personal data | Outside the tool | New situation: pass requests to see, correct or delete personal data to Julie promptly | GDPR for Teachers deck; EDPB |
| Photos | Publication permission | Also: taking, storing and publishing are different uses; inside school and in public are different | GDPR for Teachers deck |
| Before you begin | Two short notes | Six questions to ask before using personal data | GDPR for Teachers deck |
| Go ahead (3 October) | Never: every route ended in “check before acting” or “stop” | Three go-ahead answers: nobody can be identified (sharing work, a photo or a file; not apps or AI); a school system used the normal way; a use the school confirmed. The last two only after the sharing checks. Narrowed on 6 October (next row) | European Commission and AP on personal data; GDPR for Teachers deck |
| Go ahead (6 October) | “A school system, used the normal way” led to Go ahead | That answer is gone. Go ahead needs a use or workflow the school set up or confirmed (for example grades for your own classes in ManageBac), or material in which nobody can be identified. Step 2 says: an approved system does not make every kind of information, recipient or use appropriate | Privacy Officer’s email, 6 October 2026 |
| New apps, AI tools and new uses | Check with ICT first; a new tool or use goes to Julie | Check with ICT first, before real pupil or staff data is used; ICT involves Julie when a privacy assessment is needed. Same line in the app, AI, unknown-data and specialist answers and in “Who to ask” | Privacy Officer’s comments; GDPR for Teachers deck: “Not sure whether a tool is approved or appropriate? Check with IT first” |
| Unclear permissions or sharing | “Resolve the remaining checks”, asking staff to confirm permissions and retention arrangements themselves | “I am not sure” now gives “Check first, then continue”: staff do not work out permissions or sharing arrangements themselves. “Something needs changing” gives “Fix what needs changing first”. The conditions are things staff can see; retention questions go to Julie | Privacy Officer’s comments |
| Privacy Officer’s details | Name, title and ISH address | Also: at ISH on Thursdays, in the IT Office; email on other days; for urgent matters when she cannot be reached at ISH, her ICTRecht address | Her email of 6 October 2026, with her permission; GDPR for Teachers deck |
| Double click (13 October) | A fast double click, or two quick taps, could also answer the next question (for example “Yes, a confirmed use”) | The second click of a double click, and mouse or touch clicks in the first 0.3 seconds of a new screen, are ignored; the keyboard is never delayed | Found while checking a colleague’s report about a different GDPR activity; test tests/dblclick.cjs |
| App register (13 October) | No app register: every new app went to ICT first | For an app or an AI tool, staff look up the app in the foundation’s application register, one app at a time. Legacy or Contained: stop. Default or Special: shown, and the answer still needs a confirmed use. Still under review, or not shown: no claim either way, the usual questions. Where the register’s own note says AI, the AI route applies | Application register of Stichting Het Rijnlands Lyceum, export of 21 September 2026; emails of its privacy officer, 12 and 13 October 2026 |
| App register live (14 October) | A test version for the foundation’s privacy officer | Live, with his agreement, on the export of 21 September 2026. Gemini and Copilot, added to the register after that export, show as added but not yet classified, and the AI rules apply to them. The register is updated when he sends a new export, planned every month | Emails of the foundation’s privacy officer, 14 October 2026 |
| Status line | “Review version. The school’s privacy review of this guide is still open.” | “A guide, not an approval”: it does not approve apps or uses and cannot cover every situation; if in doubt, check first | Privacy Officer’s email, 6 October 2026 |
Decision-to-source map
| Decision | Evidence and boundary |
|---|---|
| New apps and data use | Live staff library → English → 02. Codes of conduct → SRL-Code of Conduct Staff v1.0.pdf, §2.5 (printed p8): application procedure and form; required supplier processing agreement before use; check whether personal data is processed. The form itself and approved workflows have not been located. A licence or school login is insufficient evidence. Whether a supplier processes data for the school: EDPB: data controller or data processor. GDPR for Teachers deck (version of 5 October 2026): “Don’t upload pupil or staff data to a new tool without checking first”; “Not sure whether a tool is approved or appropriate? Check with IT first”. Privacy Officer’s comments (6 October 2026): new apps, AI tools or new uses involving school-related personal data are checked before real pupil or staff data is used; ICT can be the first point of contact and involves Privacy where a privacy assessment is needed; staff are not expected to make legal assessments themselves. |
| Email and sharing | Same code, §2.6 (p8): school email for work, no automatic forwarding to personal email. GDPR principles: specific purpose, necessary data, appropriate security and retention. Sharing still depends on the actual authorised recipients and purpose. |
| Personal or confidential data in AI | SRL AI policy v1.2, 1 February 2026, §§4.4–4.6: check task before platform; current restrictions prohibit personal/confidential inputs. The appendix contains conflicting tool permissions. The picker does not use that appendix to authorise tools. A DPA alone does not override the policy. |
| Photos and recordings | Staff code §2.10 (p10) requires permission. AP guidance on images in education explains specific consent, under-16 parental permission, student consent from 16, and withdrawal. GDPR for Teachers deck: taking, storing and publishing a photo are different uses; internal sharing and public posting are different. The picker covers publication. Identification, safeguarding and other internal recordings need their own procedure. |
| Suspected incident | Staff code §2.12 (p10): report incidents and possible breaches. Published SRL privacy policy, p5: on-site ICT reporting. Live intranet: the school’s privacy coordinator (“privacycoördinator ISH”) is the primary privacy contact. GDPR for Teachers deck (1 October 2026): notify on-site ICT without delay, then contact Julie for privacy guidance. EDPB: controller notification without undue delay and where feasible within 72 hours, unless unlikely to risk people’s rights and freedoms. Staff report promptly; they do not decide notification duties. |
| Requests about personal data | GDPR for Teachers deck: people can ask for access, correction and erasure where it applies; refer requests promptly to Julie (Privacy Officer). EDPB: respect individuals’ rights. The picker passes these requests on; it does not decide them. |
| Lawful basis and retention | SRL privacy statement, 1 July 2025, pp2–4, and EDPB lawful processing guidance: consent is one possible basis, not the default for all school processing. The picker gives no universal retention period and does not decide legal bases. |
| Go-ahead answers | European Commission: data protection explained, “What is personal data?”: personal data relates to an identified or identifiable living person; data rendered anonymous so that the person is no longer identifiable is not personal data; pseudonymised data that can be used to re-identify a person remains personal data. AP: wat zijn persoonsgegevens? gives the same definition (art. 4(1) AVG). So material in which nobody can be identified, including its file details, comments and version history, holds no personal data; the tool keeps apps (their logins are personal data) and AI (the AI policy checks the task) out of that answer. GDPR for Teachers deck: “You work with personal data every day”, “Use approved, secure systems”, “Only give access to people who need it”, “Check recipients and attachments before sending”; new tools are checked with IT first and new uses go to Julie. The second go-ahead needs a use or workflow the school set up or confirmed, after the sharing checks. In her comments (6 October 2026) the Privacy Officer asked that a go-ahead relate to a confirmed use or workflow and not simply to a system or tool being available at ISH: an approved system does not automatically mean that every type of information, recipient or use is appropriate. The earlier answer “A school system, used the normal way” was removed for that reason. Where the use, permissions or sharing arrangements are unclear, the tool says check first. The tool relies on the staff member’s answers; it cannot verify them. |
| App register | The application register of Stichting Het Rijnlands Lyceum (export of 21 September 2026), shared with ISH on 12 October 2026 by Dennis Binnendijk, privacy officer of the foundation. His reading of its Governance column (13 October 2026): Default = approved; Special = approved for a specific purpose or school; Legacy = should no longer be used, generally being phased out or replaced; Contained = known but restricted, not to be used; unclassified or incomplete records = still under review. It is an application register, not yet an approved software catalogue, so the tool looks up one app at a time (at least three letters, matching the start of a name or of a word in it) and does not list it. Used: the entries for ISH or the whole foundation that have a Governance class (81: 22 Default, 48 Special, 11 Legacy, 0 Contained), plus five everyday systems the register lists without a class yet, shown as still under review (Google Workspace, Microsoft 365, Moodle, Gmail, OneDrive), so a search for Classroom or Teams does not only find a similar-sounding Legacy app. Only the name, class and scope are used, with a few other names for searching (for example Quizizz, Photoshop, Teams) and an AI mark where the register’s own description says AI. On 14 October 2026 he agreed that the tool may use the register in this way and go live with this export. Gemini and Copilot were added to the register after this export (his email of 14 October 2026): until an export classifies them, the tool shows them as added but not yet classified, without a scope, and the AI rules apply. The tool makes no claim about any app it does not show. An approved app does not make every use appropriate (Privacy Officer, 6 October 2026), so every go-ahead still needs a confirmed use. Where the register’s own note calls an app an AI tool, the AI route applies. |
| Privacy contact | GDPR for Teachers (staff INSET deck, revised with the Privacy Officer and Aaron Tyo-Dickerson on 1 October 2026, edited again on 5 October): Julie van Riemsdijk, Privacy Officer, whole school, j.vanriemsdijk@ishthehague.nl; on site every Thursday, IT Office; urgent and unable to reach her via ISH: j.vanriemsdijk@ictrecht.nl. She agreed on 6 October 2026 that the GDPR Check may show her Thursday day, the IT Office, her ISH address for other days and the ICTRecht address for urgent matters. The deck is cited by title; it is not linked from this page. |
Open questions for the school
Sent to Julie for testing on 1 October 2026, with Aaron Tyo-Dickerson in copy. Her comments of 6 October 2026 are applied. No school approval is claimed.
- App requests: Which current request form and approved-workflow list should staff use? Who decides, and where is the decision recorded? Until then the tool says: check with ICT first, before real pupil or staff data is used; ICT involves Julie when a privacy assessment is needed.
- Incident route: answered by the staff deck of 1 October 2026: on-site ICT without delay, then Julie. Earlier note: the English “04. Incidents & Databreaches” folder displayed “This folder is empty”, and the response-plan link in the staff code opened a document with unfilled organisation/approval placeholders.
- Photo permissions: Where do ISH staff check purpose, channel and withdrawals? The internal “Use of Passport Photos” document (26 September 2025, §§2, 4–6) combines consent wording with a legitimate-interest example; its decision clause says school approval is required but no completed approval was verified. Confirm the adopted ISH version and distinguish identification from publication.
- AI wording and mailbox: Resolve the v1.2 appendix against the main tool rules. Confirm the shared privacy mailbox: the live intranet lists privacyish@ishthehague.nl; the public ISH page lists ishprivacy@ishthehague.nl. The tool now leads with Julie’s own address, as in the staff deck.
- App register: answered by the foundation’s privacy officer on 14 October 2026: the tool may use the register in this way and go live with the current export. He will review the classes, including Google Workspace and Microsoft 365, in his next update after the autumn break, and send an updated export every month. Gemini and Copilot have been added to the register.
- Release: the GDPR Check card is on the Innovate page since 6 October 2026, shown by Alexandru Tanasel after Julie and Aaron were told the same day.
Review scenarios
- Free quiz asking for school email → app-request route; no automatic approval; ICT and the Privacy Officer check the supplier’s role and any processing agreement; who manages the accounts is one thing they look at.
- Names removed from a recognisable student report, used with AI → stop personal-data input.
- Fictional lesson prompt for AI → check task and platform rules; no automatic approval.
- Photo permitted for a newsletter, proposed for social media → check that specific publication permission.
- Wrong recipient or public file link → tell on-site ICT straight away, then Julie.
- A parent asks for every note the school holds about their child → pass the request to Julie promptly.
- All checklist answers “yes” for a use the school confirmed → go ahead within that use; anything new is checked first.
- A worksheet in which nobody can be identified, shared with a class → go ahead: no personal data in this material.
- Grades for your own classes entered in ManageBac, the way the school set it up, shown only to the people who need them → go ahead within the confirmed workflow.
- An approved system used for something new, such as health notes in a shared Drive folder or a new audience → check first: an approved system does not cover every use.
- A confirmed use, but unsure whether a permission covers it → check first, then continue; staff do not decide this themselves.
- A free app that students sign in to with their school Google account → still the app-request route: a school login does not make another app approved.
Technical tests check routing and missing-answer behaviour. They do not certify legal accuracy or school approval.