The GDPR lays down strict rules for the processing of personal data. Among other things, schools must obtain consent for the processing of sensitive data, be transparent about data use and take technical and organizational protective measures.