Every few weeks another large AI vendor announces a privacy framework for schools. Standardised district agreements, multi-state arrangements, safety standards co-signed by teacher unions. Useful documents. They are also written for American school districts under American law, and a Dutch school board cannot lean on any of them. Your obligations still come from the AVG, the Dutch name for the GDPR, and from your own procurement rules. So here is a list you can actually use in a meeting. Not legal advice, just the twelve questions we would want a school to ask us.
About where the data lives
Which country do the servers sit in, and which legal entity is the processor. Who are the subprocessors behind that entity, and can I have the list in writing. Does anything leave the EEA at any point, including for support, logging or monitoring. If a vendor cannot answer the subprocessor question within a day, that tells you something. It is a list they either maintain or they do not.
American district agreements and safety standards do not cover a Dutch school.
About the model
Is our data used to train or fine-tune any model, including the model provider underneath you. Is that in the contract, or is it on a webpage that can be edited on a Tuesday afternoon. What happens to prompts and outputs after a session ends, and how long are they kept. The second question is the one people forget. A commitment you cannot enforce is marketing.
About the people
Who can read pupil content inside your company, and under what circumstances. Is there logging of that access, and can we see it. Schools ask about hackers. The realistic risk is usually an employee with broad access and no audit trail.
About the decisions
Does the system make or influence any decision about a pupil, such as level, pace, grouping or flagging. Can a teacher see why, change it, and overrule it. Anything that steers a child without a visible reason is the part you want to look at hardest, and it is rarely the part the demo shows you.
About getting out
Can we export everything, in a format we can actually open, without asking you. What is deleted on termination, how fast, and do we get confirmation. An easy exit is the cheapest trust signal a vendor can give, which is why the ones who refuse it are interesting.
About the paperwork you still need yourself
None of the above replaces a verwerkersovereenkomst, the Dutch data processing agreement, and for anything with real impact on pupils, a DPIA, or data protection impact assessment. A vendor framework is an input to that process, not a substitute for it. The practical shortcut: ask the vendor for their DPIA support documentation up front. Companies that have done this before will hand it over immediately. Companies that have not will send you a marketing deck.
What good answers sound like
Specific, boring, and written down. A country, a company name, a retention period in days, a clause number. Bad answers are enthusiastic. Enterprise grade, bank level, fully compliant, hosted in the cloud. None of those are answers. They are adjectives. And if a vendor gets defensive when you ask, you have learned the most useful thing in the meeting.
Take these with you
- 1American district agreements and safety standards do not cover a Dutch school.
- 2Ask for the subprocessor list in writing. The speed of the reply is the signal.
- 3A promise on a webpage is not a promise in a contract.
- 4Ask who inside the company can read pupil content, and whether that access is logged.
- 5Good answers are specific and boring. Adjectives are not answers.
