Canva Education

Provider statement: schools use Canva Education to create visual content: lesson materials and student work, and administrative content such as newsletters, presentations, posters, social media graphics, websites and documents. Data entered includes user account details (provided by the user or through single sign-on) and whatever users upload or type into designs, which may include photographs and names of pupils, staff and parents. Canva processes this data. It is stored in the United States and accessed by Canva group companies in several countries and by its subprocessors, including AI providers when AI features are used. Recipients of finished designs depend on how they are shared: collaborators added to a design, anyone with a link if link sharing is turned on, the public if a design is published as a website, and third-party apps the user connects. Canva also lists integrations with learning platforms such as Google Classroom, Microsoft Teams and Canvas. Not independently verified.

Provider statement: users can be teachers and other staff, and pupils of primary and secondary age invited by a teacher. Canva's education terms define Student Data as account information only (name, email, password, school enrolment, teacher name and course enrolment) and exclude User Content, meaning the designs, uploads and text users create. The Data Processing Addendum states Canva does not intentionally collect sensitive data and that any sensitive data users include in content is determined by the customer. In practice, leadership use can put personal data into designs, including pupil photographs and names in newsletters, staff photographs, and potentially information about SEND, behaviour or wellbeing if staff use Docs or presentations for such work. Whether special category, SEND or safeguarding data is processed therefore depends entirely on what the school puts into Canva. Schools should decide what must never be entered. Not independently verified.

Provider statement: Canva needs account data (name, email, password, school, teacher and class enrolment) to run accounts. Most leadership and administrative uses, such as newsletter templates, posters and presentations, can be done without identifiable pupil information. Schools can reduce data by using staff-only accounts for communications work, not giving pupils accounts unless there is a classroom purpose, avoiding pupil names and images in designs unless consent and need are clear, and using admin controls to restrict publishing, apps and AI features. Designs are private by default, but users can switch on link sharing or publish designs as websites. Ask the provider: Can admins prevent public link sharing and website publishing for all users? Can pupil accounts be created without email addresses? Not independently verified.

Provider statement: Canva's privacy trust page states that for customers in Europe and the United Kingdom, Canva acts as processor for personal data within the customer's team. The Canva Education Additional Terms (last updated July 2022) state that creating a Canva Education account incorporates the Canva Data Processing Addendum, which makes the customer controller and Canva processor and prevails over the terms in a conflict. However, the trust page lists the Data Processing Addendum as for Canva Business and Enterprise only, and the UK schools page says Canva will provide a GDPR-compliant addendum, so how the addendum applies to a UK school's education account is unclear. The addendum allows subprocessors with 30 days' notice on Canva's subprocessor page and a 10-day objection window. The subprocessor list dated 17 April 2026 names hosting, AI and support providers mainly in the United States, plus the EU, Philippines and Australia. Canva's UK representative is EDPO UK. Ask the provider: Will Canva sign a data processing agreement with our school or trust, and which Canva entity is the contracting party for UK schools?

Provider statement: Canva's privacy trust page (checked 24 October 2026) states that Canva stores data in the United States and that data is processed by Canva group members in Australia, New Zealand, the Philippines, the United Kingdom, Singapore, Europe and the United States under an intra-group data transfer agreement. The subprocessor list dated 17 April 2026 gives Amazon Web Services hosting locations as the United States and EU, with other hosting, AI and support subprocessors in the United States, EU, Philippines and Australia. For UK data, the Data Processing Addendum incorporates the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, and the trust page says Canva carries out transfer impact assessments. The trust page also links to a Data Privacy Framework statement, which was not reviewed in this research. No option to store UK school data in the UK was found. Ask the provider: Can school data be hosted in the UK or EU? Which subprocessors access UK school data, and from where? Which transfer mechanism applies to UK school data sent to the United States? Not independently verified.

The Data Processing Addendum (updated 30 October 2025, checked 24 October 2026) says customer personal data is kept for as long as necessary for the permitted purpose or required by law, and destroyed when the agreement ends unless needed for the permitted purpose or by law. No retention periods are stated. Canva's privacy trust page says users can delete or download their data in account settings. Canva publishes a detailed retention schedule only for children under 13 in the United States (COPPA), which does not apply to UK schools. No UK retention schedule was found for staff or pupil accounts, designs, backups or AI interactions. Ask the provider: How long are staff and pupil accounts and designs kept after a user leaves or the school stops using Canva Education? How long do backups and AI subprocessors keep data? Can the school bulk-export and bulk-delete its users' content?

Provider statement: Canva states it holds ISO 27001 certification and SOC 2 Type II compliance (neither checked on an issuing body's register), runs a public bug bounty programme with Bugcrowd, and peer reviews and security tests code before release. Under the Data Processing Addendum, Canva will provide a summary audit report on request and answer written audit questions once a year. Designs are private by default. School and trust deployments use SAML 2.0 single sign-on and admin controls over elements, photos, video, music, publishing, apps and templates. The addendum requires breach notification without undue delay but gives no fixed number of hours, and says the school must not publish any breach notice identifying Canva without Canva's approval unless the law requires it. Ask the provider: How many hours after discovering a breach will the school be notified? Is multi-factor authentication available or enforceable for accounts not using SSO? Can you supply the ISO 27001 certificate and SOC 2 report?

Provider statements: in Canva Education, AI features are available to admins and teachers by default, while students have only Magic Media, Dream Lab and Magic Insights; admins can change who can access AI features (help centre, checked 24 October 2026). Canva's privacy trust page states that it does not use the content of students using Canva Education to improve AI features, and that AI privacy settings are disabled for all Canva Education users so they cannot opt in or out. The page does not explicitly say whether content created by teachers and staff in Canva Education is excluded from AI improvement, which matters for leadership use. A 2023 press report quoted a Canva commitment not to train its models on education data, but this is not stated on Canva's current trust page. AI processing involves subprocessors in the United States including OpenAI, Anthropic, ElevenLabs, Google and Amazon Web Services, plus Canva group AI entities. Third-party apps in Canva's apps marketplace follow their own terms. Ask the provider: Is content created by teachers and staff in Canva Education used to improve AI features, by Canva or any subprocessor? Do AI subprocessors retain prompts or outputs, and for how long? Can the school disable AI for all staff and pupils?

Provider statement: Canva uses machine learning to filter content that is not safe for school from its media library, with human moderators reviewing collections. Schools and trusts get usage reporting, and Canva's UK pricing page lists AI audit logs for school and trust deployments. Magic Insights, an AI data-analysis feature, is enabled for students by default. No automated decision-making about pupils or staff with legal or similarly significant effects was found in the sources. The main concern is staff or pupils using AI features to analyse or summarise information about identifiable people. Ask the provider: What do usage reports and AI audit logs record about individual users, and who can see them? Not independently verified.

Provider statement: Canva publishes a privacy policy, a privacy trust centre and transparency reports on government requests. Users can download or delete their own data in account settings, and privacy requests can be made to privacy@canva.com. Under the Data Processing Addendum, Canva will assist the school with data subject requests and pass on any requests it receives directly. Canva's UK representative for data protection is EDPO UK. Schools should name Canva in their privacy notices where staff or pupil data is processed, and tell parents if pupil images or work are created or published using Canva. Ask the provider: Can school admins export or delete a specific pupil's or staff member's content across the school account to respond to requests? Not independently verified.

Risks specific to school use, based on the sources above: (1) Staff using personal or individual teacher accounts outside a school-managed deployment, so content stays with the individual when they leave and the school has no admin controls. Safeguard: use a school or trust-wide deployment with single sign-on. (2) Pupil images and names in public-facing designs. Safeguard: check photo consent records, restrict link sharing and publishing, and review designs before release. (3) Personal data placed in designs falls outside Canva's contractual definition of Student Data. Safeguard: treat all design content as school personal data and set rules on what may be entered. (4) AI features are on for teachers by default, and AI use of staff content is not clearly excluded. Safeguard: set AI permissions deliberately and forbid entering pupil or staff personal data into AI prompts. (5) Data is stored in the US and processed in several countries, including by AI providers. Safeguard: document the transfer mechanism (SCCs plus UK Addendum) in the school's assessment. (6) Terms are US-focused, the DPA status for education is inconsistent, and liability is capped at US$100. Safeguard: request a UK data processing agreement before trust-wide rollout. (7) Third-party apps follow their own terms. Safeguard: use the apps control to restrict them.

For the school's data protection lead: a full DPIA is likely to be needed if pupils are given accounts or if pupil images and information are placed in designs, because the processing involves children's data, AI features and international transfers to the United States and other countries. For staff-only use without pupil data, the school should still record its assessment of the transfers and terms. Questions to resolve with Canva: (1) Will Canva sign a UK GDPR data processing agreement with the school or trust, and which Canva entity contracts with UK schools? (2) Does the Data Processing Addendum apply to Canva Education, given the trust page says it is for Business and Enterprise only? (3) Is staff content in Canva Education used to improve AI features? (4) Do AI subprocessors retain prompts and outputs? (5) What retention and deletion periods apply to staff and pupil accounts and content in the UK? (6) Can admins block public sharing and website publishing? (7) Can the US$100 liability cap be varied for schools? (8) Can you supply ISO 27001 and SOC 2 reports? (9) Which UK MIS or rostering tools, if any, are supported?