Free Refund Policy Generator for Online Course / LMS — GDPR Compliant

🇪🇺 Key GDPR Requirements

The GDPR (General Data Protection Regulation) is the world's most comprehensive data privacy law, applying to any organization that processes data of EU residents — regardless of where the organization is based. Non-compliance can result in fines of up to €20 million or 4% of annual global turnover, whichever is higher.

• Lawful basis for processing must be identified and documented (consent, contract, legitimate interest, etc.)
• Privacy by design and default must be embedded in your systems
• Data subjects have the right to access, rectify, erase, and port their data
• Data breaches must be reported to supervisory authorities within 72 hours
• A Data Protection Officer (DPO) is required for large-scale processing of sensitive data
• Data Processing Agreements (DPAs) required with all third-party processors
• International transfers outside the EEA require specific safeguards (SCCs, adequacy decisions)

Online Course / LMS — Specific Considerations

Online learning platforms collect student progress data, assessment results, and payment information — all of which carry specific legal obligations. If your courses issue certificates, you may hold personally identifiable data for extended periods. Students also have rights to access and delete their learning records under GDPR and CCPA.

Data typically collected by Online Course / LMS businesses: student name and email, course progress, assessment scores, certificate data, payment information, video viewing behavior

• Student data rights under FERPA/GDPR
• Certificate and credential data retention
• Video and content DRM terms
• Course access terms on refund
• Instructor data sharing (if marketplace model)