The legal protection of personal data in education is a crucial priority. Educational institutions must obtain informed consent from students before collecting, processing or sharing their data. Robust security measures are needed to prevent unauthorized access, and data collection must be restricted to what is strictly essential, encouraging data minimization. Transparency of privacy policies is essential to establish trust, and students are guaranteed rights of access and rectification. Data retention periods must be limited, followed by secure deletion. Regular evaluations are necessary to adjust policies in line with technological developments and legal changes, ensuring solid legal protection of student personal data.