Processing personal data in primary school applications in the Nemendagrunnur Student Database
This page explains how personal data is processed when applying for primary school through Reykjavík City via the Nemendagrunnur Student Database. Reykjavík City serves as the data controller, and the Center for Education and School Service acts as the data processor. Reykjavík City holds a processing agreement with the Center for Education and School Service (MMS), which operates the Nemendagrunnur Student Database.
To meet compulsory education obligations and evaluate your application in the Nemendagrunnur Student Database for your child's placement in a Reykjavík City primary school, the municipality must process specific personal data regarding the child, parents, and immediate family members as outlined here.
This includes details you provide during the application process, as well as any necessary and specifically requested additional information.
What is the purpose of the processing?
- This processing ensures compliance with the Act on Compulsory School No. 91/2008, specifically its requirements for mandatory school attendance and enrolling children in primary school. The municipality must receive relevant information about resident school-age children and applicants in a timely manner to make appropriate enrollment decisions. This information must remain current to support other services provided to students throughout their schooling.
- A parent's application for a child's school placement goes directly to the principal of the requested school. The school's information system (Mentor/Námfús) stores the data and creates a parent access account. If applying to a school in another municipality for a child whose legal residence is in Reykjavík, Reykjavík City first receives the application for approval or rejection. Upon approval, the application goes to the requested school. Reykjavík City retains access to and an overview of all applications submitted to Reykjavík City primary schools.
- Reykjavík City is required to process specific personal data to ensure compulsory education requirements are met for primary school-age children under the Act on Compulsory School No. 91/2008. Processing general personal data is based on items 3 and 5 of the first paragraph of Article 9 of the Act on Data Protection and the Processing of Personal Data No. 90/2018 and the Compulsory School Act No. 91/2008, along with the City's public authority under the Local Authorities Act No. 138/2011.
- Processing sensitive personal data relies on items 7 and 8 of the first paragraph of Article 11 of the Act on Data Protection and the Processing of Personal Data.
- If you do not provide Reykjavík City with the requested information, your application may not be processed. Under the Act on Compulsory Education, parents must provide the primary school with any information about their child necessary for school operations and the child's welfare.
Data storage
A legal obligation requires Reykjavík City to retain indefinitely the personal data processed for your child's primary school enrollment. After a specified period, all processed data must be transferred to the National Archives as required by Act No. 77/2014 on Public Archives.
What personal data is processed?
General personal data:
- Information about the child: Name, ID number, address, postal code, municipality, gender, preferred name if different from the registered name, choice of personal pronouns, current preschool or school, and language. Information about the child's academic history, previous schools, and enrolled grade levels.
- Information about parents and guardians: The system retrieves parent information from Registers Iceland via My Pages on Ísland.is, including name, ID number, address, postal code, municipality, email address, phone number, language, and whether the parent requires an interpreter.
- Information generated through the use of Ísland.is—such as service data, log records, and other technical details including IP addresses and browser versions used to ensure safety and identify errors—is subject to the Ísland.is privacy policy.
- Information about immediate family members: Full name, ID number, phone number, and relationship.
Sensitive personal data:
- Information about the child: Allergies, intolerances, any medical diagnosis requiring a school response, and requests for medication assistance; support needs, special provisions, or involvement in service integration for the child's prosperity; information from child protection services regarding temporary foster care; and applications for international protection or refugee status.
Where does the information come from?
The system retrieves basic information from Registers Iceland via My Pages on Ísland.is and provides it to the Center for Education and School Service. The applicant then provides additional details through the primary school enrollment application.
How long is the personal data kept?
Reykjavík City is a mandatory records-transferring party under the Act on Public Archives No. 77/2014. The City transfers documents to the National Archives after the specified retention period elapses, in accordance with this legislation.
How do we ensure the security of personal data?
The City of Reykjavík safeguards personal data through appropriate organizational and technical measures, including access controls and encryption. All City staff involved in processing an applicant's personal data are bound by confidentiality.
Sharing personal data with third parties
As noted, Reykjavík City must transfer all data processed in connection with primary school enrollment applications to the National Archives after the specified retention period.
A processing agreement is in place with the Center for Education and School Service, which operates the Nemendagrunnur Student Database.
The City of Reykjavík will not share any other personal data belonging to you with third parties unless the City is required to do so on the basis of law, governmental orders, or a court order. Furthermore, the City will not share your personal data outside the European Economic Area without express authorization and without informing you accordingly.
Who has access to information in the Nemendagrunnur Student Database
- This information goes to the primary school where the child will begin their studies. Other Reykjavík City staff receive work-related access, strictly controlled according to their individual permissions.
- If applying to a school outside the child's school district, the district school may also receive necessary information.
- If applying to a primary school in another municipality, that municipality may also receive necessary information.
- The municipality's case management system (Hlaðan) and the school's learning and information system (Mentor/Námfús) record this data and generate access accounts for parents and students. Parents submit applications through the Nemendagrunnur Student Database, and guardians may view information related to their children in accordance with the Children's Act No. 76/2003.
Automatic decision making
No decisions are automated. Staff members review all applications.
Your rights
You may have the right to access the personal data that the City of Reykjavík processes in connection with your application. You may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format. More information about these rights can be found in Reykjavík City's Privacy Policy.
Complaints about processing
Please note that if you're dissatisfied with Reykjavík City's handling of your personal information, you can always contact the City's Data Protection Officer (personuverndarfulltrui@reykjavik.is) or file a complaint with the Icelandic Data Protection Authority (postur@personuvernd.is).