Increasing concerns about secure data storage in schools too

UTRECHT, March 9, 2026 – ICT workers in primary and secondary education are worried about the security of school data. More than half say those concerns are greater than five years ago. At the same time, attention is growing on dependence on US cloud services. This is according to research by DUO-Onderwijs among 219 ICT employees in PO and VO.

For many schools, the physical location where data from their most important educational systems is stored plays an important role when choosing external parties. Almost six in 10 ICT employees in primary education (PO) indicate that the storage location is an important or even decisive factor when selecting digital system suppliers. In secondary education (VO), this is even the case for 73% of ICT employees.

In doing so, many schools have a clear preference for storage within Europe. In PO, 20% of those surveyed demanded that data remain entirely within Europe, in VO even 53%.

The survey shows that ICT staff in VO have better insight into where school data is physically stored. For instance, 72% of them have full or mostly insight into the storage location of key systems. In PO, over half (52%) of ICT staff have no or limited insight into this.

In VO, 46% indicates that all data are stored within the EU, while 20% does not know where the data are located. In PO, the ambiguity is considerably greater: there, 38% indicates that all data are within the EU, but 47% does not know where the data are stored.

Erik Trimp, director of DUO-Onderwijs, is pleased to see a growing focus on data security within schools as well. “Schools work with sensitive data of pupils, parents and staff on a daily basis. It is therefore important that they have insight into where data is stored and under what conditions.”

At the same time, the survey shows that there are still steps to be taken. “In primary education in particular, almost half of ICT staff still have no or limited understanding of this. So there is still a challenge for schools there.”

Many ICT employees say they are well aware of the obligations under the AVG. About three quarters of respondents say they are well aware of these. With newer European regulations, such as the NIS2 directive and the Data Act, the situation is different. Especially in PO, familiarity with these rules is still limited.

This could indicate, according to the researchers, that while concerns about privacy and data security are growing, schools are also presumably still searching for how to deal with new European regulations and their reliance on large technology companies.

This survey was conducted in February 2026 among 138 ICT staff in primary education and 81 ICT staff in secondary education.

DUO-Onderwijs* is an independent research and consultancy firm with a team of researchers, educationalists and consultants. DUO-Onderwijs has been providing schools and school relations with insight and direction for practical and strategic choices for 30 years. Careful handling of pupil, parent and staff data is central to this. All data within DUO-Onderwijs's systems is stored within the European Economic Area (EEA) and complies with applicable privacy legislation. DUO-Onderwijs is ISO-certified and a member of the Data & Insights Network.

*DUO-Onderwijs has no relationship with the Education Executive Agency.

Contact
For more information, contact Marjolein Nadorp (deputy director) on 06-26 54 31 12 or m.nadorp@duo-onderwijs.nl.