UNICEF: Data Governance For EdTech

We contributed to the public consultation process on data governance for educational technology (EdTech), conducted by UNICEF Innocenti, Global Office of Research and Foresight, in partnership with UNESCO and the Global Privacy Assembly (GPA), the international coordinating body for data protection authorities (DPAs) representing more than 130 member institutions worldwide. The review was prepared by Emma Day, Jasmina Byrne and Melanie Penagos, and draws on a survey of 82 DPAs globally, 15 structured interviews with education ministries, DPAs, and EdTech companies, and over 170 publications. It aims to explore the current state of data governance for EdTech, identify the key challenges facing stakeholders in protecting children's rights, and map existing governance mechanisms across different national and regional contexts.

Related

• UNESCO’s AI Competency Frameworks

• UNESCO: Science Report 8th Edition (2026)

Data Governance for EdTech

Education technology is increasingly promoted as a solution to persistent global education challenges — from the 250 million children still out of school, to a shortfall of 44 million teachers, and widespread learning poverty affecting seven in ten 10-year-olds in low- and middle-income countries. The landscape review addresses governments and legislators, data protection authorities, education ministries, EdTech companies, civil society, investors, and, critically, children themselves as primary rights-holders. The governance of data processed through EdTech intersects children's rights to privacy, education, non-discrimination, and autonomy, and is examined through the lens of the UN Convention on the Rights of the Child, the UN Guiding Principles on Business and Human Rights, and applicable data protection frameworks including the GDPR and AI-specific legislation such as the EU AI Act, under which AI systems used in education are classified as high-risk.

The review finds that regulation remains globally inconsistent, with only 16 per cent of countries having laws specifically protecting children's data privacy in education as of 2023. Data ownership in EdTech products typically rests with private providers, and current rules generally allow a one-way flow of data from public education systems to the private sector, with no corresponding obligation for EdTech companies to share data back with public authorities or researchers. Half of the DPAs surveyed were aware of data breaches involving EdTech companies in their jurisdiction, while UNESCO reported the education sector accounted for 30 per cent of global security breaches in 2022. Foresight analysis further identifies emerging risks from agentic AI, neurotechnology integration, and fragmented geopolitical governance as amplifying these vulnerabilities.

The review advances ten overarching policy recommendations, spanning the establishment of common definitions and technical standards, strengthened legal and regulatory frameworks with anticipatory governance mechanisms, rights-based business models, robust data protection and child rights impact assessments, enhanced DPA oversight and enforcement capacity, transparency obligations for EdTech providers, data literacy across all stakeholder groups, multi-stakeholder and multilateral collaboration, data governance requirements embedded in public procurement rules, and mitigation of the environmental impacts of large-scale EdTech data processing. Across all recommendations, the review emphasizes that only inclusive, multi-stakeholder governance, meaningfully engaging children, civil society, regulators, and the private sector, can build an EdTech ecosystem that protects children's rights while realizing the full potential of digital innovation in education.

• • •

References

¹ Day, E., J. Byrne and M. Penagos. "Data Governance for EdTech." Landscape Review. UNICEF Innocenti – Global Office of Research and Foresight. Florence: UNICEF Innocenti. September 2025.

² Day, E., J. Byrne and M. Penagos. "Data Governance for EdTech: Policy Recommendations." UNICEF Innocenti – Global Office of Research and Foresight. Florence: UNICEF Innocenti. September 2025.

³ United Nations Educational, Scientific and Cultural Organization. "Global Education Monitoring Report 2023: Technology in Education – A Tool on Whose Terms?" Paris: UNESCO. 2023.

⁴ Global Privacy Assembly. "Strategic Plan 2023–2025." GPA. October 2023.

⁵ Organisation for Economic Co-operation and Development. "OECD Digital Education Outlook 2023: Towards an Effective Digital Education Ecosystem." Paris: OECD Publishing. 2023.

⁶ United Nations Children's Fund. "Policy Guidance on AI for Children." New York: UNICEF. November 2021.