FAQ for schools

A data controller determines the purposes for which and the means by which personal data is processed. So, if your organization decides 'why' and 'how' personal data should be processed, it is a data controller.

A data processor holds and processes data on behalf of a data controller. A data processor is usually a third party, and the duties of the processor towards the controller must be specified in a contract or another legal agreement.

Schools can choose to accept the new terms if they wish. If you choose not to accept the new data processor mode terms, your use of ChromeOS will still be GDPR compliant, but Google will remain a data controller rather than primarily a data processor. Google’s processing of personal data will be covered by the Google Privacy Policy, rather than the data processor mode terms of service. For more specific guidance, please contact your local authority.

For more information, see Workspace for Education.

Data processor mode is currently available in these countries, with more coming soon.

You can only activate data processor mode for managed ChromeOS accounts on managed ChromeOS devices, such as Chromebooks, which are running the latest version of ChromeOS and Chrome browser. Data processor mode does not work on earlier versions of ChromeOS and Chrome browser, unmanaged devices or accounts, devices running ChromeOS Flex, or non-ChromeOS devices such as Macbooks or PCs. Chrome Education Upgrade or Chrome Enterprise Upgrade is required to manage ChromeOS devices and to activate data processor mode.

ChromeOS can continue to be used in compliance with GDPR whether or not these new terms are accepted. You simply now have the option to accept these new terms and switch Google’s role from a data controller to primarily a data processor. For more specific guidance, please contact your local authority.

No, turning off Optional Services will not impact the usability of Chromebooks. Only Essential Services are on by default. Optional Services can be turned on or off manually.

As a data controller, you have responsibilities with regards to Data Subject Access Requests (DSAR) and deletion requests. To use the new tools made available with data processor mode such as Download Service Data, Takeout Customer Data, and User Deletion Request, simply access them through the Google Admin console after accepting the terms of service.

Navigate to the Optional Services tab on the product landing page of the Admin console. Click the link for each Optional Service and follow each service’s policy settings to turn it on or off.