All about DPIA Google Workspace

On July 8, an agreement was reached with Google on measures aimed at the previously identified privacy risks with Google Workspace for Education. This means that schools can continue to use Google Workspace for Education, provided they also implement some actions themselves. This is the result of intensive discussions that SURF, SIVON and the Strategic Supplier Management Authority for the State (SLM-Rijk), partly at the request of the PO-raad and VO-raad, have held with Google.

The agreements contain a comprehensive set of contractual, organizational and technical measures. These adequately cover the high privacy risks identified by the Personal Data Authority on May 31, 2021.

This statement by SURF and SIVON describes this achieved result. Google will start working on technical modifications but schools will also have to carry out some actions themselves in order to (continue to) use Google safely. SIVON and SURF will provide support in this by means of a manual.

Actions for educational institutions

• Adjust settings: in addition to automatic changes in the application, the system administrator will also have to adjust some settings in the Workspace environment. A manual for that will be available in the first week of August.   
• Additional instructions: the secure use also requires explanation to the users. Not everything can be arranged technically, but will have to be done via user instructions. These will also become available centrally in the first week of August.
• Modify contract: in the first week of August information will follow on how the modified privacy terms with Google should be accepted. This too is a one-off activity. 
• Do your own impact analysis: the institution remains responsible for assessing whether the way Google Workspace for Education (Plus) is used is secure. A packet with everything needed to do such an assessment will follow in the first week of August.  

The amount of work per institution depends on the amount of Google applications an institution has in use, but is expected to take anywhere from 1 to several day slots.

DPIA on Chrome browser

Together with SIVON, we are still working on an impact analysis (DPIA) on the Chrome browser and the system running on the Chromebooks. At this moment there is no definite answer to this question. Information about this will follow later.  

Support from SURF

To help you implement the necessary changes, we offer the following support: 

• An information package for the management of institutions will become available in in the first week of August, enabling you to implement the changes. 

More information

A full list of news items can be found on this page.