What are you looking for?

Most searched:

Most searched:

Improved accessibility mode

SURF strives for a website that is accessible to everyone. We are working on a full accessibility mode.
Student achter laptop kijkt op telefoon, voorin beeld een roze drinkfles, op de achtergrond praten twee studenten aan een tafel
News

Data Protection Impact Assessment

DPIA update: Xedule is making significant progress

SURF has published a DPIA update on Xedule. Xedule has reduced 11 of the 17 initial high risks to low or medium. This leaves 6 high risks, 1 medium risk, and 1 new low risk. The related mitigation measures will be implemented by the first quarter of 2027 at the latest. Our advice remains the same: institutions can continue to use Xedule for the time being.
Reading time 2 minutes

Xedule provides cloud-based logistics solutions for planning and timetable processes within the education sector. Its applications are used throughout the education sector. Xedule is a particularly well-known name in secondary vocational and higher education. 

Overview of all risks and measures 

In the original Data Protection Impact Assessment (DPIA) of 8 July 2025, 17 high-risk issues were identified for which Xedule was required to take action. The update shows that measures have been implemented for 11 of these 17 risks, thereby reducing them to low or medium risk.  

The measures taken by Xedule include: an updated data processing agreement, privacy warnings for certain fields in the application, and automatically configurable retention periods for certain data groups. Xedule also aims to mitigate the remaining 6 high risks and has committed to doing so by the first quarter of 2027 at the latest. 

Xedule is migrating its digital infrastructure to Microsoft. As a result, risks relating to non-EU data transfers apply. This is identified as a new low-risk issue in the DPIA update.  

Xedule will implement the remaining measures by the first quarter of 2027 at the latest. SURF will verify these and subsequently publish a final update with accompanying advice. 

To minimise risks, it remains important for institutions to implement the measures mentioned earlier. The table in Part D (page 105) of the DPIA update sets out what applies to both the institutions and Xedule (14 measures) and what applies only to the institutions (1 measure). 

Full report publicly available  

The full findings of the investigation can be found in the DPIA (Dutch).

Related topics: