The Inviolability of Private Life
The legal basis of pupil data confidentiality at school level is Article 17 of the Law on General Education. Under this norm, the private life of the pupil, the parent and the teacher is inviolable — they may not be required to disclose information about their private life. This general guarantee extends to the EdTech context as well: any processing of pupil data collected in a system must be assessed through the prism of this inviolability.
The limits should also be noted: the school has the right to require a pupil and a teacher to undergo medical screening for diseases, alcohol and drugs, but is obliged to ensure the accessibility of such screening; and the arbitrary restriction of the inviolability of private life, private communication, or property in the school's ownership but transferred for personal use is impermissible.
The Collection and Storage of Data
Under paragraph 2 of Article 17, in collecting and storing the personal data of the pupil, the parent and the teacher, the school is obliged to be guided by the requirements of this law and the General Administrative Code of Georgia. The processing must therefore be read through both the constitutional guarantee and the specific statutory rules at once.
For digital systems this means that an EdTech platform is not a legal vacuum: the data entered into it is protected by the same rules as paper records — and the school is responsible for ensuring that its technological partner also satisfies these requirements. The choice of a technology provider is thus a legal decision as much as a commercial one.
The Separation of Academic and Disciplinary Data
A direct norm of the law: information on the pupil's academic progress must be stored separately from disciplinary data. This is the lawful expression of the principles of minimisation and delineation: data of different purposes must be separated from one another.
For an EdTech solution this is a technical requirement: mixing academic and disciplinary records in a single profile is a violation of the law, and the system architecture must provide for this separation from the outset.