In forceGDPR10 min read

GDPR Compliance for AI Training Providers

An online training provider may process account, payment, learning, assessment, certificate and support data. GDPR compliance starts by mapping each processing purpose, choosing a valid legal basis, minimising data, controlling processors, setting retention periods and making individual rights work in practice.

Applies from: 25 May 2018
For: Online academies, course providers, learning platforms and training teams
Last legally reviewed: 30 September 2026

Educational guidance: This overview explains EU rules in general terms. Applicability depends on the organisation, system, service and national law.

Map the learner journey before writing the privacy notice

The privacy notice should describe real processing rather than an idealised template. Map data from the first website visit through checkout, account access, course progress, assessment, certificate verification, support, marketing and deletion.

For every purpose, record the categories of data, people affected, legal basis, recipients, international transfers, retention period and security controls. Payment providers and email services may have different roles and contractual requirements.

Use the correct legal basis for each purpose

Consent is not the default legal basis for all processing. Delivering a purchased course may rely on performance of a contract, while legal records may need to be retained to meet a legal obligation. Marketing, analytics and optional personalisation require their own analysis.

Where consent is used, it must be demonstrable, specific and capable of being withdrawn. Refusing optional consent should not prevent access to a service that does not need that processing.

Make individual rights operational

Access, correction, erasure, restriction, objection and portability requests need an owned workflow. The organisation should record every request, verify identity proportionately where appropriate, assign responsibility, locate data across systems and track the initial one-calendar-month response period. A complex or numerous request may justify an extension of up to two further months, but the individual must be informed within the first month and given the reasons.

Completing or automatically deleting data does not remove the duty to answer the person. The record should show what was assessed and done, any applicable exception, when and how the result or refusal was communicated, and the proportionate audit evidence retained.

Certificates and learning records need deliberate retention

Course progress, assessment answers and certificate records should not be retained indefinitely merely because storage is inexpensive. Retention should reflect the stated purpose, contractual needs, fraud prevention, certificate verification and applicable accounting or legal obligations.

Public certificate verification should expose only the information genuinely needed for verification and should provide a route to correct or revoke a record.

Action list

Practical checklist

Map data across visits, sales, learning, assessment and support.
Assign and document a legal basis for each purpose.
Maintain processor agreements and transfer safeguards.
Publish an accurate, layered privacy notice.
Operate and test the data-rights workflow.
Set and execute retention and deletion rules.
Maintain breach identification and notification procedures.

Questions

Common questions

Does an online course provider need consent to process all learner data?

No. Different purposes can rely on different legal bases. Contract delivery, legal obligations, legitimate interests and consent must each be assessed against the actual processing.

Can assessment and certificate data be kept forever?

Not automatically. GDPR storage limitation requires a justified retention period connected to the purpose and any applicable legal obligations.

Must every deletion request result in deleting every record?

No. The right to erasure has conditions and exceptions, but the request must still be assessed and answered within the applicable timetable.

Primary material

Official sources

Last legally reviewed: 30 September 2026. Recheck the consolidated legislation and relevant national implementation before relying on this guide for a specific decision.