This paper reports on the Erasmus+ Spadatas project, focused on supporting schools in their integration of European GDPR data protection in their practices. We see schools as ecologies, characterized by groups of actors interacting within a locality, defined by physical spaces, shared culture and tools. Teachers emerged as the main actors, experiencing the problems created by the digitization of the school, such as the way that digital platforms and social media were compromising the privacy and safety of the school ecology. Building on these insights, we have reconfigured our original aim, conducting a participatory, citizen science inquiry with teachers as central actors, and their students, mediating across other actors and ecologies beyond their immediate sphere of influence. It was decided to provide a digital suite composed of two tools: the first tool is a series of self-evaluation questionnaires, enabling teachers and colleagues to be aware of their level of proficiency in adopting competences, practices, and tools to effectively protect the pupils from data breaches. The second tool is a digital game-simulation, called Viral Sphere, addressing teachers’ and their students’ desires for resources to foster a dialogue on GDPR. This paper presents insights from summative evaluations of the Spadatas digital suite with partners and schools in Denmark and Italy, focusing on three emerging, intersecting dimensions: ecological boundaries, technology and practice, and dialogue and identity.