SkieHow does GDPR apply to school device management?
If your organisation handles the personal data of people in the European Economic Area or the UK, GDPR or its UK equivalent may apply to how you use device management. Skie provides controls such as roles, narrow data collection and an audit log. It does not make an organisation compliant. This is general information, not legal advice.
GDPR is the European Union's data protection law, and the United Kingdom has its own version. Both turn on the same ideas: a lawful basis for processing, being open about what you collect, collecting no more than you need, keeping it secure and respecting people's rights to ask about their data.
In a school setting the school is usually the controller, the body that decides why and how pupils' data is used. A vendor that processes data on its behalf is a processor. Controllers are expected to have a written agreement with their processors and to know where data is held and who else handles it.
Skie's approach lines up with the principle of collecting only what is needed. It records device identity, installed apps, compliance status and, where the organisation uses it, location. It does not collect message content, call logs, audio or video. Roles limit access. The enterprise product stores data in an India region, which an organisation outside India should weigh in its own review of international transfers.
Not everything is a software feature. Deciding your lawful basis, writing notices for children and parents, completing any impact assessment and handling requests are tasks for the organisation. For some of them, Skie's team can supply information, but it cannot take the responsibility.
A practical tip: if you are in the EU or UK, speak to your data protection officer before the pilot and ask for a short assessment. Bring the data list from this knowledge base, the privacy policy and your draft agreement. Starting with those documents makes the review much quicker.