Guide
Pupils under 14 at a Spanish school: who consents, what can be photographed, and who sees what.
Reviewed on
The short answer
Below the age of 14, when processing a pupil’s data relies on consent, parents or legal guardians give it; from 14, the pupil can give it themselves. That is article 7 of Spain’s data protection law, the LOPDGDD.
A school does not need consent for the data it uses to educate, such as the register, marks or the photo on the pupil’s record. It does need it to publish photos or videos openly: on the website, on social media or anywhere reachable without a password.
Health data should only be seen by staff who need it for their job, and the software the school uses is a data processor bound by a contract.
Who gives consent, by age
The LOPDGDD, art. 7 is clear: processing a minor’s data can only rest on their own consent if they are over 14. Below that age, consent must come from whoever holds parental authority or guardianship. Spain is using the room that GDPR art. 8 leaves to member states.
The Catalan Department of Education adds two useful points (school data protection guidance): with shared parental authority, either parent can give consent regardless of custody, and the school must check the pupil’s age and that the consent is genuine.
For images, Organic Law 1/1982, art. 3 says the minor should consent personally if mature enough. That is why secondary pupils usually sign the image consent too.
What a school can do without asking
The Education Act (LOE), 23rd additional provision allows schools to process the data needed for teaching and guidance. The AEPD’s guide for schools expressly includes the photo that identifies a pupil on their record.
No consent is needed either to photograph or record a class activity that is part of teaching, as long as only the pupils taking part, their teachers and the families involved can see the images, in a restricted space. What is always required is telling families about it.
Photos: when consent is needed and when it is not
| Situation | Consent needed? | What to do |
|---|---|---|
| Photo on the pupil’s record | No | Say so at enrolment. |
| Photos of a class activity, in a private school space | No, if it is part of teaching | Inform families and limit who can see them. |
| Photos on the website, a blog or social media | Yes, specific and in advance | A consent form stating the purpose, the exact channels, whether access is public, and how long it lasts. |
| Photos taken by families at an event open to the public | Not the school’s matter: it is personal use | Remind them they cannot post them without the consent of the people shown. |
| Photos by an outside photographer hired by the school | Yes | The head obtains it before the event. |
A pupil without consent is not left out of the activity: they are made unidentifiable (blurring, framing). Article 92 of the LOPDGDD requires schools to protect the child’s best interests in anything they publish online. Both points are in the Department’s guidance.
Health data, reports and who sees what
Health data is a special category (GDPR, art. 9): allergies, diabetes, medication, disabilities, and also educational psychology reports, as the AEPD points out. A school may collect it when it is needed for teaching or for school lunches.
The rule is need to know. According to the AEPD, each piece of data should only be accessed by those who need it for their role. The lunchtime supervisor needs to know a pupil cannot eat gluten; she does not need the diagnosis.
WhatsApp, messages and parent groups
The AEPD advises against instant messaging between teachers and families or between teachers and pupils, and the Catalan Department asks schools to avoid it and never to send health data or family circumstances through it. Communication should go through the channels the school provides.
A WhatsApp group set up by parents on their own is not the school’s responsibility, but the school should not promote it or use it as an official channel.
The school is the controller; the software is the processor
The school decides what the data is used for: it is the controller. The company behind the management software processes it on the school’s behalf: it is the processor. GDPR article 28 requires a contract covering instructions, security measures, sub-processors and what happens to the data when the service ends.
The Department’s guidance also expects the platform to let the school export and get its data back, delete it at the end and keep activity logs. These are worth asking about before signing.
Frequently asked questions
Can a 15-year-old pupil consent to us publishing their photo on the website?
Yes. From 14, the pupil can give consent personally (LOPDGDD, art. 7). Many schools still ask the family to sign so they are informed, but the consent that counts is the pupil’s.
If one parent consents to photos and the other does not, what do we do?
With shared parental authority, the Catalan Department says either parent can consent. If there is an open dispute between them, family courts resolve it, not the school: until then, the careful option is not to publish.
Can we post the school trip photos on the school’s Instagram?
Only of pupils whose consent mentions social media. Everyone else should not be identifiable. Article 92 of the LOPDGDD requires consent for any publication on social networks.
Does the class teacher need to know a pupil has diabetes?
They need what they must know to act: that the pupil is diabetic and what to do if they feel unwell. They do not need the full medical report.
Once a pupil turns 18, do parents still see the marks?
Not automatically. The AEPD accepts that parents who pay for the studies or support the pupil may request them, as they have a legitimate interest. This guide is not legal advice: for a specific case, ask the school’s data protection officer.
How Auladia does it
When a teacher uploads photos, Auladia warns them if a pupil without image consent appears, and that photo stays hidden. Pupils under 14 have no account of their own. No teacher can hold a private conversation with a pupil under 18: the legal guardian is always copied in, or the conversation is a group one. At 18, the account becomes the pupil’s own, and they decide, parent by parent, whether their parents keep seeing their data and, separately, whether they can deal with the school on their behalf.
Health data, educational psychology reports and court rulings are not visible to any teacher. Staff who may consult them do so with a second factor, and every access is logged. The most sensitive fields are encrypted with a key specific to each school, and notifications show no personal data on the lock screen.
Auladia is the processor and signs the data processing agreement before any real data is loaded, but the school’s compliance also depends on its own consent forms and procedures. We hold no data protection certification.
Who sees what in AuladiaSources
The rules and official documents this guide cites.
- Organic Law 3/2018 on personal data protection (LOPDGDD), articles 7 and 92 (Spanish) BOE
- Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), articles 6, 8, 9 and 28 EUR-Lex
- Organic Law 1/1982 on the right to honour, privacy and one’s own image, article 3 (Spanish) BOE
- Organic Law 2/2006 on Education (LOE), twenty-third additional provision (Spanish) BOE
- Guide for schools (Spanish) Spanish Data Protection Agency (AEPD)
- School organisation and management documents: Personal data protection (Catalan) Catalan Department of Education and Vocational Training
This guide explains the rules; it is not legal or tax advice. Published on .
Want to see it on screen?
In the demo we show you how Auladia handles it with a made-up school’s data, and what it does not do yet.
Request a demo