LGPD in the classroom: questions for evaluating a platform

Before adopting an education platform, a school needs to understand which data is processed, for what purpose, and by whom. This guide is an assessment sheet based on LGPD principles and ANPD guidance. It is not legal advice or a certification of SimulAI or any other tool.

Why this is the teacher's responsibility too

A school or institution must identify its role and that of its vendors in data processing. Under ANPD guidance on processing agents, roles depend on actual decisions about purpose and means; a teacher’s job title alone does not settle the classification. Consult the data protection officer and legal advisers before enrolling a class.

Purpose: use data only for what was agreed

A purpose and lawful basis must be identified for each processing operation. An email address used for an account cannot simply be reused for a different purpose without appropriate analysis. SimulAI’s Privacy Policy describes declared uses; schools should compare them with contracts and their own context.

Minimization: collect the minimum necessary

Request only data necessary for the activity. Names, email addresses, uploaded files, and usage logs can serve different purposes; do not include IDs, addresses, or sensitive data in an exercise for convenience. Consult the published policy and verify required fields in the actual configuration before using a tool with students.

Transparency: explain what happens to the data

Inform data subjects in accessible language which data is processed, why, with whom it may be shared, and for how long. Adapt communication for minors and institutional rules. Do not assume a published policy replaces clear guidance for the class and guardians where appropriate.

Security: what to ask the vendor

Ask for evidence of security measures suited to the risk, such as protection in transit, storage, access control, and incident response. This list is a due-diligence agenda, not a technical certification of any vendor:

• Is traffic protected in transit? How is that configured and verified?
• Which data is protected at rest, by which service, and with what key management?
• Who has role-based access, and how are permissions reviewed?
• Which events are logged and how long are logs retained?

SimulAI’s Privacy Policy declares security measures. This article has not audited infrastructure, keys, logs, or cloud contracts; request specific documentation when the institution needs proof. Teachers should also avoid sharing credentials or exporting grades and personal data without need.

Children's and teenagers' data

ANPD Statement 1/2023 clarifies that children’s and teenagers’ data may be processed under LGPD articles 7 or 11 if their best interests are observed and prevail in the specific case. The right basis, consent requirements where applicable, and advertising rules require institutional review; this text does not authorize automatic enrollment of minors.

The rights a student can exercise

LGPD provides rights including confirmation, access, correction and, under legal conditions, deletion or portability. These rights have conditions and limits: a deletion request does not automatically remove every record. Route the request through the contact channel in the policy and consult the institution’s data protection officer.

A quick checklist before adopting a tool

Use the list below to start a documented discussion with the vendor. A “yes” to every question does not replace evidence or legal analysis of the specific use:

• Is there a clear, accessible privacy policy stating what data is collected and why?
• Does the tool collect only what is necessary for the activity, or does it ask for data that makes no sense for a classroom task?
• How does the vendor describe advertising purposes and any use of performance data?
• Can the vendor demonstrate protection in transit and at rest with documentation?
• Is it easy to exercise rights, view, correct or delete data, and is there a contact channel for that?
• How are minors’ best interests assessed, and which advertising rules apply?

What to ask the vendor

Request written details of data categories, purposes and proposed lawful bases, retention periods, processors and subprocessors, international transfers, security measures, incident procedures, and the rights contact channel. Keep the answers and review them with the school’s data protection officer.

In short

Responsible adoption depends on assessing necessity, risk, contracts, actual configuration, and the best interests of children and teenagers where involved. This sheet guides questions; it does not prove a platform compliant or replace legal advice.