Serious data protection violations must be reported to the supervisory authority immediately. Violations can be punished as an administrative offense or a criminal offense, with custodial sentences or fines possible. In practice, the school supervisory authority usually responds with notices and instructions.