What are you looking for?

Improved accessibility mode

SURF strives for a website that is accessible to everyone. We are working on a full accessibility mode.
Studente op laptop aan het werk in de hal van de VU
News

Education can continue using the scheduling tool for now

Xedule uses SURF DPIA to further strengthen its privacy policy

SURF conducted a Data Protection Impact Assessment (DPIA) on Xedule, a cloud-based solution for planning and scheduling processes in education. We identified 17 high risks and 1 medium risk. Xedule has indicated it will take measures within a reasonable timeframe. Institutions can therefore continue to use Xedule for the time being.

A large part of the risks is administrative in nature. SURF will check at the end of March 2026 whether the measures have been implemented. Xedule actively assists educational institutions with the measures they need to take themselves.

Intensive collaboration

Xedule provides logistical cloud solutions for planning and scheduling processes within education. The applications are used across the entire education sector, but the company is particularly well known in secondary vocational and higher education. The company is pleased with the completion of the DPIA and the intensive collaboration with SURF.

Karin Kuster, managing director at Xedule: "We are pleased with the specific outcomes of this DPIA. Safeguarding privacy is crucial in our solutions, and the input from this DPIA allows us to further strengthen our approach. The intensive collaboration with SURF was focused and transparent. SURF shows that conducting DPIAs makes a positive contribution to the quality of widely used software in education. This sets a high standard for all suppliers within the education sector."

Sophia Gelpke, privacy lawyer at SURF: ''The need of institutions for a DPIA, combined with Xedule’s own initiative to start one, led to this process. From day one, it was clear that Xedule approached the process positively. Xedule has seized this DPIA with both hands to further enhance the security of its software and services. This gives us the confidence that, after the review at the end of March 2026, we will be able to give a positive recommendation regarding its use."

Full report publicly available

The full findings of the study can be found in the Data Protection Impact Assessment (DPIA).

Questions?

If so, please contact SURF at vendorcompliance@surf.nl or Xedule at privacy@xedule.nl

Related topics: