How do I find the right backup for my digital teacher calendar on the iPad

Simply enable auto-backup in GoodNotes, and you're done. Now you can relax knowing that a copy of your data is regularly created in the background and saved to the cloud. But what about users who use personal data on their iPads at school? In times of GDPR, the Cloud Act, and other regulations, this is a question that's no longer so easy to answer.

I investigated this question and tested several backup systems. If you are a teacher and want to back up your data in compliance with GDPR, you can find the necessary information here. Whether my suggested methods are permissible under data protection and educational law at your school must always be clarified with your school administration or your school's data protection officer, as the school administration is generally responsible for data protection. Since I create digital teacher calendars, I would like to show teachers suitable ways to securely store data on their tablets.

Backups

What is a backup?

Backup involves creating a backup copy on a suitable storage medium. Storage media can be divided into physical storage (USB sticks, external hard drives, etc.) and online storage, known as cloud storage. In the event of data loss, the backup can be used to restore the previously saved data.

Why are regular backups important?

Backups are essential, whether you're a student or a teacher. Your device can break, get stolen, or, in the case of a digital planner, you can accidentally delete pages and the hyperlinks will no longer work. Once pages are deleted, the corresponding hyperlink becomes irreparable. Backups are especially important for teachers, because they are responsible for safeguarding their students' data.

Cloud storage

Cloud services and GDPR

The increasingly popular online storage options, so-called cloud storage, enable data transfer regardless of location and time. Cloud storage services such as Microsoft OneDrive, iCloud, Google Drive, and others provide an infrastructure with virtually unlimited storage capacity. While they are now indispensable in everyday life, they have some weaknesses when it comes to protecting personal data. Many cloud providers are foreign companies that operate their large server farms outside of Germany or the EU. One thing to note here is that different countries require different data protection regulations. The EU has stricter requirements for handling sensitive data than other countries, such as the USA, where many companies such as Microsoft, Dropbox, and Google now operate their data centers. The EU-US Privacy Shield served as the data protection basis for the storage of personal data in the USA and other third countries, but was invalidated in 2020 by a ruling of the European Court of Justice (ECJ) . This may make the use of cloud services outside the EU and the European Economic Area no longer GDPR-compliant. American cloud services are subject to the CLOUD Act. This law allows US federal agencies to access all data stored in a cloud. This would not protect the data from third-party access. Even if we are located here in Europe and the law doesn't directly affect us, our data is under the control and custody of the US providers. Two laws are crucial for schools in Germany: the EU-wide GDPR and the respective state data protection law.

"The Cloud Act and the GDPR are incompatible. Any data transfer to the US based on the Cloud Act is fundamentally contrary to the basic principles of the GDPR. In particular, there is no legal basis for the data transfer required by the GDPR to protect the individual's informational self-determination." (Source: Dr. Thorsten Hennrich https://www.plusserver.com/blog/cloud-act)

A data protection agreement could provide certainty here, regulating the rights and obligations of both parties. According to Article 28 of the GDPR, a contract is required if the school uses personal data stored online outside the EU.

Contract for order processing

Due to a lack of work devices in schools, many teachers use their private devices for student lists, student observations, etc. If personal data from the school is to be stored externally, this requires a data processing agreement (AVV; AV contract, formerly ADV contract) between the school and the cloud provider. The AVV cannot be concluded between the teacher and the cloud provider, but only between the school and the cloud provider. If such an AVV does not exist between the school and the cloud provider, the use of a non-GDPR-compliant cloud to secure personal data by teachers is not permitted. If no in-house solution exists, a German or European cloud provider for school purposes that is not subject to the CLOUD Act would be conceivable. In any case, the appropriate backup of personal data must be agreed upon with the school administration. The legal requirements of school and data protection legislation must be strictly adhered to.

GDPR-compliant cloud services

To be on the safe side, you should use a cloud service that is headquartered and operates its servers exclusively in Germany or a country within the EU or the European Economic Area. Such cloud providers are very likely to comply with GDPR requirements. NextCloud and HPI School Cloud are examples of GDPR-compliant cloud solutions. Your school administration can certainly provide you with the necessary information.

GoodNotes in schools

I keep reading that GoodNotes isn't allowed to be used for school purposes due to data protection reasons. However, GoodNotes doesn't use online storage to store your files, as many people assume; instead, the data is stored offline, locally on your device. Only when synchronization is enabled will your files be uploaded to iCloud. For these reasons, no data processing agreement is required between GoodNotes and the school, as no data processing takes place at GN. GoodNotes states the following in its privacy policy:

"If you don't choose to backup or sync to a cloud storage or use the optional features of GoodNotes Cloud, all your documents are only saved locally on your device." (Source: https://www.goodnotes.com/privacy-policy/)

When setting up automatic backups, you can currently choose between OneDrive, Dropbox, and Google Drive. One small criticism here is that GN doesn't currently offer integrated support for WebDAV. WebDAV would allow you to link an automatic backup to a GDPR-compliant server of your choice, such as your school server. However, pressure is growing on GN as more and more GN users are calling for this feature, so I hope GN will integrate WebDAV in the foreseeable future. You can vote for WebDAV in GoodNotes here to help raise awareness of the issue.

Backup strategies

In the following illustration, I've illustrated the backup options. Depending on the device you use and whether or not you use sensitive data in your digital planner, there are different backup options. This is my personal recommendation. All decisions must be ultimately agreed upon with your school administration.

Figure: Backup systems on your iPad

1.) Private tablet/iPad

Whether you are permitted to use your private tablet for school purposes must be clarified with the school administration. The same applies to the use of sensitive data on your private device. Some schools recommend anonymization or pseudonymization. Different state laws make it impossible to give a general answer here. In general, teachers are not permitted to use private devices for work purposes. However, since schools did not provide teachers with work devices in the past, this resulted in private devices, such as desktop computers at home, being used to store student data. Teachers must store this data securely and safely. Approval from the school administration is required in all cases.

2.) Personal data

According to Article 4 No. 1 According to the General Data Protection Regulation, personal data is "[...] any information relating to an identified or identifiable natural person." ( Art. 4 No. 1 GDPR). In the context of student data, personal data includes: surname, maiden name, first name, gender, date of birth, religious denomination, class/year, etc.

3.) Create backup with external storage media

The use of an external storage device is a good option because it allows for the use of a cloud-based backup. This option can be a particularly suitable backup method for users who handle sensitive data. Of course, this must be agreed upon with the school administration. The vulnerabilities of physical devices primarily concern theft, loss, and longevity. Therefore, it is advisable to perform regular backups. To prevent this, it's best to make a backup of the backup . Data encryption and password protection are other useful tools for preventing unauthorized access.

Backup systems when using personal data

In my search for a suitable backup system, I tried several external storage devices through trial and error. Some didn't work at all, others worked only satisfactorily, and in the end, I settled on a backup system that I'd like to introduce to you now. First, a little about the SanDisk, which is also often used for external storage, but in my opinion, isn't suitable for digital teacher calendars. I use my iPad Pro and the GoodNotes app for the backup option.

SanDisk - 32 GB Lightning iXpand - not recommended for digital planners

The first drive I tried was the 32 GB Lightning iXpand. You had to install an app to use it, which didn't bother me. However, I quickly noticed that the drive couldn't handle large files, which is not uncommon when storing a digital planner, and I had problems saving and restoring. This is a fatal problem when creating backups, which is why I can't recommend this method for a digital planner. It's great for photos!

Apple "Lightning to USB Camera Adapter" + USB stick - recommended variant

For this backup option, you'll need the "Lightning to USB Camera Adapter" * and a USB stick. Lightning is the interface for Apple devices developed by Apple itself since 2012. Most iPads have a Lightning connector. However, for my iPad Pro (2018), I need a USB-C to USB adapter. * To back up your tablet with a Lightning connector, follow these steps:

1. Connect the Lightning adapter and USB stick to the tablet
2. Open digital planner in GoodNotes
3. Export the entire document (planner) or selected pages as a .goodnotes file. Important: If you want to export an editable .goodnotes file, make sure the export settings are set correctly. Exporting the GoodNotes file as "immutable" will also destroy the hyperlinks. The file will remain intact, but the hyperlinks will no longer work.
4. Name the file Example: 211215_Backup_Filename and click Export
5. “Back up to files” and select the USB stick
6. Create a folder for backup on the USB stick and click “Backup”
7. Once it's saved, peel the sticker off the iPad.
8. Check if the export worked.

Restore files from USB stick to tablet

If you want to restore your backup, follow these steps:

1. Connect the adapter + USB sticker to your tablet
2. Open Files and select the folder for your USB stick
3. Select the previously saved file
4. Go to “Share”, then “open in GoodNotes”
5. The document will be imported into GoodNotes. Be sure to select "Import into new document," otherwise the document will be merged with the one you already have open. This isn't a good look.

4.) Create a manual backup

You have the option to create a manual backup in GoodNotes. This will back up all GoodNotes files to their current state. Alternatively, you can also export individual documents/pages. This way, you can create a backup of all your documents:

1. Click on the arrow in the top left corner to get to the overview of all your documents
2. Now click on the gear in the top right corner and then select “Settings”
3. Go to “Create Backup”
4. Then click on "Create backup now"
5. This may take a few minutes. Important: You need sufficient free memory for this.
6. After the backup has been successfully completed, you will receive a .zip file. Save this .zip file in a GDPR-compliant cloud storage. If you don't have one, first save the .zip file locally on your device and then transfer it to another storage medium (see point 3).

5.) Automatic backup with cloud server

Should you no sensitive data , you can safely rely on a cloud server as a backup strategy. I use a combination of iCloud and OneDrive because OneDrive offers the option to restore files back 30 days. If I accidentally delete a document or remove a hyperlink, this feature is worth its weight in gold! iCloud gives me additional security by creating an automatic backup of itself. For this to happen, iCloud backup must be enabled in the settings:

Create automatic backup in GoodNotes

In the automatic backup settings, you can currently choose between OneDrive, Dropbox, and Google Drive. If you've just opened your digital planner in GoodNotes, follow these steps:

1. Click on the arrow in the top left corner to get to the overview of all your documents
2. Now click on the gear in the top right corner and then select “Settings”
3. Go to “Automatic Backup”
4. Enable auto-backup
5. Sign in with your desired cloud storage
6. Enable “Upload only via Wi-Fi and Bluetooth”
7. Select a destination folder. If one does not exist, create one
8. Set the file format to “GoodNotes & PDF” so that both formats are saved
9. Click on “Done”

Important: Make sure occasionally check whether the backup was successful. It can It could be that a file is causing a backup backlog. In the auto-backup settings, you'll find the option "Show backup queue." If you click on it, there's an option at the bottom to "Clear queue." The backup process will then start again from the beginning and should complete successfully.

6.) School provides service equipment

If you use your work device for school, it's important to know whether the school specifies a backup solution. If so, you must, of course, follow it. Installing apps on work devices yourself is most likely not permitted/feasible. Typically, the school provides not only the tablet but also the apps installed on it.

Conclusion

Anyone using personal data in a digital teacher planner should address data protection issues and also consult with the responsible person, which in most cases is the school administration. As is often the case, open and honest communication is very important when dealing with sensitive topics. If you are not permitted to create automatic backups via the cloud servers provided by GoodNotes, you can use physical storage devices or GDPR-compliant servers with manual backups to back up your data. Ideally, you should enter the time and date for backup in your digital planner or a calendar of your choice so you don't forget it, because once the data is lost, it will be difficult to recover.

outlook

For the future, I would like to see a more targeted approach to data protection in Germany. Data protection is very important, but in my opinion, it's simply regressive to block ourselves from functioning systems. A contract for data processing with the cloud storage provider will hopefully solve the problems of cloud storage of personal data in the near future. In this debate, Bremen is a positive and current example of taking a step in the right direction and now allows the use of iCloud in schools. Unfortunately, in the other states, it's very unclear what's possible/feasible, and in the end, everyone cooks their own soup.

Important: This article represents my personal opinion. In any case, it is essential to clarify with the school administration whether this type of storage with external storage media is permitted, as the respective data protection regulations of the states and schools apply here.

Link collection:

1. https://news.datenschutz-schule.info/2021/09/25/bremen-ermoeglicht-nutz-von-icloud-zur-processing-von-personal-daten-mit-normalem-schutzbedarf/

2. https://datenschutz-schule.info/2020/02/19/lehr-apps-und-cloud-speicher/

3. https://keyed.de/blog/storage-personal-related-data/

4. https://www.boxcryptor.com

5. https://datenschutz-schule.info/tag/av-vertrag/

6. https://datenschutz-schule.info/themen/dienstgeraete-fuer-lehrkraefte-umstellung-der-leitung/dienstgeraete-fuer-lehrkraefte/

7. https://www.goodnotes.com/privacy-policy/

8. https://datenschutz-schule.info/themen/usb-sticks-und-datensicherheit/

9. https://www.ionos.de

10. https://it.kultus-bw.de/site/pbs-bw-km-root/get/params_E-1758151725/4695606/Hinweise-mobile-Endgeraete-im-Unterricht.pdf

11. https://www.herole.de/blog/datenschutz-schule/

12. https://t3n.de/news/cloud-act-compliance-datensicherheit-recht-1382018/

13. https://datenschutz-schule.info/tag/private-endgeraete/

14. https://www.datenschutz.rlp.de

15. https://www.iitr.de/blog/datenschutz-in-der-schule-ist-eine-datenrechner-durch-rechner-an-ihrem-haeuslichen-computer-zulaessig/3312/

16. https://datenschutzanwalt-dsgvo.com/datenschutz-in-der-schule-was-gilt-es-zu-beachten/

17. https://www.dataguard.de

18. https://www.goodnotes.com/privacy-policy/

The links marked with an asterisk (*) are affiliate links. If you click on such an affiliate link and make a purchase through that link, I receive a commission from the respective online shop or provider. The price does not change for you.