Data protection for private schools and nurseries: Swiss FADP, minors and platforms
By Advisorn · updated on 26 October 2026
In brief
Private schools and private nurseries fall under the FADP; public schools follow the cantonal data protection laws instead. They process data of minors, often also on health, which is sensitive personal data (Art. 5 let. c FADP): they need to inform parents, obtain their consent for photos and non-essential uses, take security measures and have contracts with digital platforms.
The typical data
- data of pupils and parents;
- assessments, school reports and communications with families;
- allergies, medication, special educational needs;
- photos and videos of activities;
- accounts on learning and communication platforms.
Sensitive personal data
Allergies, illnesses and diagnoses, including those behind support at school, are health data, which are sensitive personal data (Art. 5 let. c FADP): only those who need them may know them, and they must never be published.
Minors and parents
A minor who has capacity of judgement may decide alone on strictly personal rights (Art. 19c CC); for younger children the parents decide. In practice a school asks the parents' consent for photos, outings and tools that are not indispensable, and also informs the pupils in words suited to their age.
Digital platforms
- the provider of the learning or communication platform is a processor: a contract is needed;
- check where the data is and whether the provider uses it for its own purposes, for example advertising or training AI models;
- prefer accounts managed by the school to pupils' personal accounts;
- for tools with a lot of data on minors or sensitive data, a data protection impact assessment.
Related questions
- Children's data: do special rules apply?
- May photos of employees or customers be published on the website or social media?
- What is sensitive personal data?
- Can Microsoft 365 or Google Workspace be used under the new FADP?
- May personal data be entered into ChatGPT or other AI tools?
- Does the new FADP require employees to be trained?
Useful templates
- Parental consent form template for processing a child's data
- Parental consent withdrawal form template
- Privacy notice template for customers and contractual partners
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Technical and organisational security measures (TOMs) template
- Employee data protection training programme template
The other sectors
General information, not advice on your case: for your case the text of the law is what counts, and for a sector with rules of its own, those rules too.