Data processing & cloud: what music schools must check

What data processing means

Data processing exists when a service processes personal data not for its own purposes, but on your behalf. The music school stays responsible; the cloud provider processes according to instructions.

That separation matters: you remain responsible for how the data is handled, even when someone else processes it technically.

The data processing agreement

A data processing agreement (DPA) regulates what the provider may and may not do with the data. It is mandatory when a processor is involved – and should be available before use, not only on request.

Serious providers publish the DPA or link it in their privacy policy. If it is missing, that is a warning sign.

Which questions matter before use

• Where is the data stored (EU or third country)?
• Is there a DPA and is it viewable?
• Which sub-processors are involved?
• How are access and deletion regulated?

These four questions cover most of the risk – and can usually be answered from the privacy policy and the DPA.

Third countries and sub-processors

Particularly relevant is whether data is processed outside the EU. That is not forbidden, but tied to additional safeguards. Sub-processors – such as a hosting provider – should also be named.

A provider that presents these points transparently makes your check easy. A provider that avoids them rather does not.

Follow the actual flow of data

Do not begin only by asking where a provider is based. Check what information you enter into the service, why it is needed and which systems are involved. At a music school this may include contact and appointment details, lesson notes or recordings. For each category, consider whether it is necessary for the specific purpose.

Then trace what happens next: who can access the data, which sub-processors are involved, and what happens during support, export or deletion? The privacy notice and DPA should tell a consistent story. If something is unclear, a specific written question to the provider is more useful than a general assurance that “everything is secure”.

Review technical and organisational safeguards

A contract does not remove the need to review safeguards. Ask how accounts are protected, data is transferred and backups are secured. For everyday school operations, it also matters whether people have individual accounts rather than shared passwords and whether former team members lose access promptly.

Safeguards should fit the risks and the data being processed. A short responsibility list can make the review practical: who creates accounts, who can export data, who reports an incident and who checks permissions? Where binding requirements or sensitive data are involved, consult the appropriate privacy lead or qualified legal adviser.

Plan for contract end and provider changes

Consider the end before you start: can you export the data you need in a usable format? How long do copies remain in backups, and how is deletion after the contract confirmed? A simple transition plan prevents lesson data from being rushed into personal folders or unprotected spreadsheets.

Decide who requests an export and how it will be transferred securely. Check that the export contains the information your school actually needs without carrying unnecessary data. Backups and statutory retention duties may require special handling; clarify them in advance and do not promise immediate erasure if the provider cannot guarantee it.

Document the review and keep it current

A short review record is often enough for day-to-day use: service, data categories, purpose, agreement, key sub-processors and open questions. That means the school does not have to reconstruct the decision from memory whenever staff change.

Repeat the review when the service, contract terms or way you use it changes materially. A brief annual check can help identify outdated assumptions. Documentation is not a certification and does not replace legal advice, but it makes clear the basis on which the school uses the service.

How MUSIRIS handles this

MUSIRIS is designed as a data-protection-friendly tool for music teaching. The privacy policy transparently describes which data is processed; for music schools we are happy to clarify the contractual questions in a direct conversation.

Questions? Get in touch – we will help you prepare the check for your school.