GDPR Compliance
Last Updated: February 5, 2026
GlobalIDPRO is fully committed to GDPR compliance for EU/EEA schools and institutions. Our platform collects zero biometric data, uses OTP-only authentication, generates ephemeral Runtime QR codes, stores EU school data in Frankfurt (eu-central-1), and operates under a clear school-as-controller / GlobalIDPRO-as-processor architecture — making GDPR compliance straightforward for every school we serve.
What Is GDPR & Why It Matters for Schools
EU General Data Protection Regulation (2018)
The General Data Protection Regulation (GDPR) is the world's strongest privacy law, governing how organizations collect, process, and protect personal data of EU/EEA residents. It grants individuals extensive rights over their personal data and imposes strict obligations on data controllers and processors — with fines up to €20 million or 4% of global turnover.
For schools operating in or serving students from the EU/EEA, GDPR compliance is mandatory. This includes international schools with EU students, schools offering distance learning to EU residents, and any institution processing personal data of children under Article 8. GDPR applies to all digital identity platforms used by these schools — including student records, parent contact data, and visitor management systems.
GlobalIDPRO makes GDPR compliance effortless: our zero-biometric architecture eliminates the highest-risk category of personal data (Article 9 "special categories"), our OTP-only authentication requires no passwords, and our Runtime QR codes are ephemeral — they expire in seconds and store no persistent data. Schools using GlobalIDPRO can demonstrate GDPR compliance through our built-in tools.
Our GDPR Architecture
School = Data Controller
Your school determines what data is collected and why. GlobalIDPRO acts as data processor — processing data only on your instructions, as defined in our Data Processing Agreement (DPA).
GlobalIDPRO = Data Processor
We process personal data solely to provide the services your school has subscribed to. We do not use school data for our own purposes, advertising, or analytics beyond anonymized service improvement.
Zero Article 9 Data
We collect no biometric data (fingerprints, facial recognition, iris scans) — which are "special category" data under GDPR Article 9. This eliminates the strictest GDPR requirements and highest-risk processing.
Lawful Basis: Contract + Consent
Data is processed under GDPR Article 6(1)(b) — performance of a contract (school subscription), and Article 6(1)(a) — consent (for optional features like visitor photo capture and print vendor data sharing).
OTP = No Passwords
OTP-only authentication means we never store passwords. Phone numbers used for OTP are provided by the school — no additional personal data is collected from parents or staff.
Runtime QR = No Stored Data
Runtime QR codes are ephemeral tokens — generated on-demand, validated server-side, expired in seconds. No personal data is encoded in the QR code itself; it contains only an encrypted session token.
EU Data Residency
EU/EEA school data is stored in AWS Frankfurt (eu-central-1). No EU personal data leaves the EU unless the school explicitly requests cross-border functionality with appropriate safeguards.
DPA Provided
Every EU school receives a pre-signed Data Processing Agreement (DPA) covering all GDPR Article 28 requirements — sub-processors, security measures, breach notification, audit rights, and data deletion.
Your GDPR Rights
All rights fully supported for parents, staff, and visitors
Under GDPR, you have the following rights regarding your personal data (and your children's data). GlobalIDPRO enables every right:
Right to Access (Art. 15)
Request a complete copy of all personal data we process about you or your child. Delivered within 30 days in machine-readable format (CSV/JSON).
Right to Rectification (Art. 16)
Correct inaccurate or incomplete personal data. School admins can update directly; parents can request corrections through the school or DPO.
Right to Erasure (Art. 17)
Request deletion of your personal data ("right to be forgotten"). Upon school account termination, all data is permanently deleted within 30 days.
Right to Portability (Art. 20)
Receive all your personal data in a structured, commonly used, machine-readable format (CSV/JSON) for transfer to another provider.
Right to Restrict (Art. 18)
Request that we limit processing of your personal data while a dispute is resolved or while you exercise other rights.
Right to Object (Art. 21)
Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
Right to Withdraw Consent (Art. 7)
Withdraw consent for any consent-based processing at any time. Withdrawal does not affect lawfulness of prior processing.
Right to Lodge Complaint (Art. 77)
File a complaint with your local EU/EEA Data Protection Authority (DPA) if you believe your data rights have been violated.
Response Timeline: All GDPR rights requests are acknowledged within 72 hours and completed within 30 days (extendable by 60 days for complex requests, with notification). Contact our DPO at dpo@globalidpro.com
How We Ensure GDPR Compliance
Privacy by Design (Art. 25)
Lawful Processing (Art. 6)
Data Security (Art. 32)
Third-Party Processors (Art. 28)
Data Subject Rights (Arts. 15-22)
Accountability (Art. 5(2))
Children's Data Under GDPR
Article 8 — Conditions applicable to child's consent
GDPR Article 8 requires parental consent for processing personal data of children under 16 (or lower age set by member states, minimum 13). GlobalIDPRO's architecture is specifically designed to exceed these requirements:
Why Zero Biometric Data Matters Under GDPR
Under GDPR, biometric data (fingerprints, facial recognition) is classified as "special category data" under Article 9 — subject to the strictest processing requirements. For children, this creates compounding compliance burdens:
GlobalIDPRO eliminates ALL of these requirements by collecting zero biometric data. Schools using GlobalIDPRO never need Article 9 consent, never need biometric DPIAs, and face zero risk of biometric data breach.
International Data Transfers
GDPR Chapter V restricts transfer of personal data outside the EU/EEA. GlobalIDPRO ensures full compliance:
Data Breach Procedures
GDPR Articles 33 & 34 — Breach notification
In the unlikely event of a personal data breach, GlobalIDPRO follows a strict incident response procedure aligned with GDPR Articles 33 and 34:
Detect & Contain
Automated monitoring detects anomalies. Security team contains the breach immediately. Affected systems isolated.
Assess Impact
Evaluate scope: what data, how many individuals, risk level. Determine GDPR notification obligations.
Notify Authority
Report to relevant EU/EEA supervisory authority within 72 hours per Article 33 (if risk to individuals).
Notify Affected
Inform affected schools and individuals per Article 34 if breach likely results in high risk to rights/freedoms.
Breach risk reduction: GlobalIDPRO's zero-biometric, OTP-only, ephemeral QR architecture dramatically reduces breach impact. Even in a worst-case scenario, no biometric data can be exposed (we don't have any), QR codes are already expired (useless to attackers), and OTP codes are single-use (cannot be replayed). The most sensitive data at risk would be names, photos, and phone numbers — all of which can be changed, unlike biometrics.
Cross-Compliance with Other Regulations
GlobalIDPRO's GDPR-compliant architecture also satisfies requirements of these additional data protection frameworks:
Contact Our Data Protection Officer
For any GDPR-related questions, data subject rights requests, DPA inquiries, or to report a data protection concern — contact our DPO directly.