The Andalusian regional government has reportedly been sanctioned for transferring the personal data of more than half a million students and tens of thousands of teachers to Microsoft in exchange for free access to the company’s virtual education platform. Information from the reported findings, the Council for Transparency and Data Protection of Andalusia said the Junta had failed over the past six years to safeguard the privacy of 525,000 minors, 74,000 teachers and around 1,000 schools, violating several articles of the European General Data Protection Regulation (GDPR).
The Council reportedly imposed six sanctions on the regional government: two classified as very serious, three as serious and one as minor. No financial penalty was issued. The most severe infractions reportedly involved transferring personal data to third countries without adequate guarantees, including the United Arab Emirates, South Africa and India, and failing to tell students and staff how their data would be used. The Council was also reported to have noted that the European Commission does not consider many of these countries to have sufficient data protection standards.
Reported serious breaches also included inadequate measures to reduce the risk of leaks involving highly sensitive data, such as health information, and the storage of inappropriate images and videos on Microsoft’s cloud. The Junta allegedly failed to conduct the legally required impact assessment or register international transfers of minors’ data. Students and teachers reportedly gave no prior consent before their data was handed over in return for free use of Microsoft’s virtual tools, including Office applications, OneDrive and Teams.
The Council reportedly found that the regional government had failed to put technical and organizational safeguards in place to limit the risks of uploading special category data to the cloud. This includes information about health, religion, ideology, beliefs, sexual life or racial origin. Everyday school activities, such as sharing political opinions in essays or uploading psychopedagogical reports, could result in sensitive information being processed without students and their families knowing or consenting.
This is not the first time Andalusia has faced criticism over its handling of educational data. In 2020, a similar agreement with Google reportedly exposed data from more than 738,000 minors and 43,000 teachers, and was also censured by the Data Protection authority. Microsoft and Google now dominate the virtual learning environment for 1.2 million students in the region, representing two-thirds of Andalusia’s primary and secondary education system.
The Council reportedly decided against a financial penalty to protect the right to education and prevent disruption to impressive digital services. The Junta has until July 31 to present a new action plan, developed with Microsoft, to address the identified failures and limit ongoing risks. The current agreement with Microsoft, first signed in 2020 and renewed in 2022 and 2024, is set to expire in November, with a new contract expected before then.
Microsoft has not been sanctioned by the Andalusian authority and declined to clarify its compliance with European regulations, stating only that it is committed to data protection laws. The regional government has played down the reported sanctions, saying it already has a corrective plan similar to the one previously approved for Google. Critics argue that the repeated breaches point to a deeper problem: reliance on foreign tech giants and a lack of transparency in handling sensitive educational data.
Separately, in October 2026, José Antonio Nieto, Andalusia’s regional minister for Artificial Intelligence, Digital Development and Public Administration and president of the Andalusian Digital Agency, announced plans to deploy 36,000 Microsoft 365 licenses and generative AI tools for the regional government’s general administrative staff. Europa Press reported the announcement after a meeting of the agency’s governing council. It concerned government employees, not students or teachers, and was a separate administrative initiative.
Data misuse and regulatory oversight have also come under scrutiny in other regions. In Valencia, for example, authorities uncovered a large-scale investment fraud, as detailed in this report on a Ponzi scheme investigation. The circumstances differ, but both cases highlight the challenges Spanish authorities face in protecting citizens’ interests amid complex digital and financial environments.
Under EU law, health data and other special categories receive strict protection because of their potential impact on individuals’ privacy and Fundamental Rights. The Andalusian Council’s reported resolution says that, while safeguarding education is a priority, authorities must also ensure strong data protection. The regional education department is expected to deliver a comprehensive risk assessment and corrective plan this summer. The debate centers on the tension between digital modernization in schools and the need to uphold privacy standards for minors and educators. The do not independently confirm the reported resolution or its findings.
