Building an AI Tutor or Edtech Product in Armenia: Children’s Data, School Contracts and Model Training

An AI tutor that processes the data of pupils under 16 in Armenia needs a lawful basis for every use of that data, and where that basis is consent, a parent or other legal representative must give it. The rules sit in Law HO-49-N on Protection of Personal Data of 18 May 2015, in force since 1 July 2015 and most recently consolidated with effect from 15 August 2026. Armenia has no edtech-specific or AI-specific data statute, so the general law decides who is responsible in a school deployment, whether chat logs may train a model, and whether developers in Yerevan may open records held abroad.

For the general framework, see our guides to Armenia’s personal data law for foreign companies and lawful bases and consent requirements. This page covers what changes when the data subjects are children and the product is an AI tutor.

Who is responsible: the school, the vendor or the developer?

The Armenian law does not use the GDPR words controller and processor. It uses two terms of its own. The data processor (Article 3(1)(5)) is whoever organises or carries out the processing; in a school deployment that is normally the school. The authorised person (Article 3(1)(16)) is someone the data processor commissions, by contract or under law, to process data on its behalf; an edtech vendor serving a school usually sits here. Your contracts should name these roles expressly, because a GDPR-style label in an English-language template does not map neatly onto the Armenian definitions.

Under Article 14, the school remains responsible for processing within the scope of its assignment. The vendor may process pupil data only within that assignment. If the assignment itself breaches the law, the vendor must tell the school in writing and refuse to carry it out. The same rules apply when the commissioning body is a public or municipal school (Article 14(4)).

The role follows the activity. A vendor that uses pupil data for its own ends, such as analytics for other customers, advertising or training a general model, is organising processing for itself and is likely to be a data processor in its own right for that activity, with its own need for a lawful basis.

Where the software developer fits

Processing includes storage, access and alteration, so a development team that can see identifiable pupil records is part of the chain whatever its job title. The law contains no express sub-processor regime, and no Agency interpretation was found on whether a vendor may bring in a developer without the school’s separate approval. The cautious course is to name the developer, and the access it has, in the school’s written assignment, require the school’s written approval for any further provider, and bind the developer to the same restrictions as the vendor.

Can a school hand pupil data to a commercial vendor without parental consent?

No express education-law basis was found for a school to disclose pupil data to a commercial vendor without consent. The education instruments identified, including the Law on General Education HO-160-N and Ministry orders on school records, deal with school registers and state information systems, and one of them states that pupil data are processed under the personal data law. The general rules therefore apply: processing without consent is allowed only where a law directly provides for it (Article 9(5)), and disclosure to a third party without consent only where a law provides for it and the data are adequately protected (Article 26(1)). A vendor acting strictly as the school’s authorised person is in a different position from a third party using the data for its own purposes, and your contract should make clear which one you are.

What the school contract must contain

Article 14(2) requires the assignment to be in writing and to state:

• the legal grounds and conditions for the processing;
• its purpose;
• the list of personal data to be processed;
• the categories of data subjects (pupils, parents, teachers);
• the persons to whom the data may be transferred;
• the technical and organisational protection measures;
• any other necessary information.

The assignment can sit in the service agreement or in a data-processing annex to it. Beyond that statutory minimum, schools and vendors usually add clauses that make the law workable in practice:

• Prohibited uses. Analytics, advertising and model training each dealt with expressly, with training either excluded or given its own basis.
• Pupils’ rights. Article 20 gives a data subject access to information about their data, generally within five days, and requires inaccurate or unlawful data to be corrected immediately or, if that is impossible, within three working days. The vendor has to be able to help the school meet those deadlines.
• Security. Article 19 requires encryption measures, restricted access and confidentiality that continues after a person’s duties end.
• Breaches. The incident duties in Article 21(4), described below, and a deadline for the vendor to alert the school. The law sets no vendor-to-school deadline, so the contract has to.
• Retention and deletion, developer access, international transfers, audit rights and liability.

The procurement contract with the school is not consent from the pupil. Article 9(4)(2) deems consent given only where data are obtained under a contract with the data subject, and a pupil is not a party to the school’s agreement with you.

Consent for children under 16

Article 9(9) provides that where the data subject is under 16, lacks legal capacity or has limited capacity, consent to processing is given by the data subject’s legal representative. The threshold is 16, so pupils aged 16 and 17 consent for themselves. The statute says legal representative: it does not require both parents to sign, does not say which parent prevails if they disagree, and does not make the school a representative. A school can collect parental consent on your behalf, but the consent is the parent’s.

For onboarding flows, three provisions matter:

• Form (Article 9(7)). Consent may be written, given electronically and confirmed by an electronic digital signature, or, if given orally, evidenced by acts that reliably show it. Whether an unsigned checkbox meets this standard has not been settled.
• Proof (Article 9(8)). The data processor carries the burden of proving consent was given. Keep the record, the version of the notice shown and the time.
• Notice (Article 10). Before consent, the parent must be told the legal basis and purpose, the data and the operations performed on it, who may receive the data, who is processing it and where, how to request correction or deletion, how long consent lasts, and how to withdraw it and with what consequences.

The Court of Cassation has held that consent must be freely given, specific, informed and unambiguous, and cannot be implied from a bare reference to a set of rules (case ED/12041/02/19, 24 June 2022). The Agency’s guidance on children’s data adds that consent is not free where refusing it carries negative consequences, which is a problem for any product that makes access to schoolwork conditional on an unrelated use of the child’s data.

Can pupils’ conversations be used to train your model?

Only with a lawful basis that covers training specifically. Armenian law contains no general permission, exemption or research exception for training AI models on personal data, and it has no GDPR-style legitimate-interests ground. Article 4(2) says data processed for specified purposes may not be used for other purposes without the data subject’s consent, and Article 5(3) bars processing that is unnecessary for, or incompatible with, the purpose. Delivering tutoring to a pupil and developing a model are separate purposes, so consent to the first does not carry over to the second, and a vendor working under a school’s assignment cannot derive a training purpose from it (Article 14).

Training that is disclosed and consented to from the outset can be one of the original purposes. A general line such as “we may use your data to improve our services” is unlikely to be specific enough, given the Agency’s position that consent without the precise purpose is not acceptable. Whether personalising the same tutor for the same child falls within the tutoring purpose, and where training a shared model begins, depends on the facts and has not been addressed by the regulator.

Anonymisation

Article 5(4) prohibits processing personal data where the purpose can be achieved with depersonalised data. Depersonalisation means it is impossible to tell whose data they are (Article 3(1)(9)), so stripping names from a chat log in which a child describes their school, family or health does not reach that standard. No Armenian standard yet says what level of anonymisation is enough for free-text conversations.

Withdrawal of consent

Under Article 21(6), after receiving a withdrawal in signed written form or with an electronic signature, the data processor must stop processing and destroy the data within ten working days, unless the law provides otherwise or the parties have agreed otherwise, and must tell the data subject within three working days after destruction. Whether a model already trained on the data must be retrained or have the data removed has not been decided by any Armenian court or by the Agency, and your training pipeline should be built so that the question can be answered either way.

Sensitive content

Children tell tutors things. Health, religion, ethnicity and similar information are special categories that may be processed only with consent unless a law provides otherwise (Article 12), and voice or face features may be biometric data (Article 13). Whether inferred profiles, such as a flagged learning difficulty or an emotional assessment, count as special-category data is unsettled.

Developers in Armenia, pupil data abroad

Article 27 governs transfers of personal data to another country and works in layers:

1. The transfer needs a basis: the data subject’s consent, or the transfer follows from or is necessary for the purposes of the processing (Article 27(1)).
2. No Agency permission is needed if the destination ensures a sufficient level of protection, which is deemed to be the case where the transfer follows an international treaty or the country is on the list the Agency officially publishes (Article 27(2)).
3. To any other country, data may be transferred only with the Agency’s permission, under a contract whose safeguards the Agency has approved as sufficient (Article 27(3)). The data subject’s consent does not replace this permission.
4. The application is made in writing before the transfer, naming the country, the recipient and its legal form, the data, the purposes and the contract or draft contract. The Agency must grant or refuse it within 30 days (Article 27(4)).

The current list was set by Decision N ԱՏՊՊ-001/24 of the Head of the Agency, adopted on 8 July 2024 and in force since 10 July 2024; the official legal database ARLIS shows it in force, with no later amendment, as checked on 27 October 2026. It names 53 countries, including all 27 EU member states, the United Kingdom, Switzerland, Japan, the Republic of Korea and Singapore. Its United States entry is limited to “United States of America (organisations)”, so confirm that a particular US recipient falls within it. The Agency must review the list at least once a year and publish any change (Article 27(5)), so check it again before relying on it for a new transfer.

Two situations come up repeatedly. An Armenian product sending pupil data to cloud servers or an AI model provider abroad is making a transfer, and needs the list, a treaty or a permission. An Armenian development team opening records that a foreign parent company holds about foreign pupils raises a different question: the Armenian team is likely acting as the parent’s authorised person, so the written-assignment rules of Article 14 apply in Armenia, while the foreign data-protection law governs the parent’s own transfer to Armenia. No Agency guidance was found on remote access or transient routing, so map the actual data flows before deciding what applies.

Agency notification, security and breaches

Armenia has no universal registration of data processors. Notifying the Agency of your processing is voluntary under Article 23(1) and becomes mandatory if the Agency demands it (Article 23(2)). The exception is biometric or special-category data: you must notify the Agency before you start processing it (Article 23(3)). The Agency approved a new notification form in June 2026.

If personal data leak from an electronic system, Article 21(4) requires the data processor to publish an announcement immediately and, at the same time, report the leak to the police and to the Agency. There is no 72-hour window and no risk threshold of the kind familiar from the GDPR. Law HO-447-N, in force since 4 January 2026, repealed parts of Article 19 and moved technical security requirements for information systems to government and agency rules, so check the current implementing acts when you design your security controls.

A draft law that would create an independent data-protection commission and introduce data-protection officers and impact assessments is pending. It is not yet law.

Selling into the US and EU

An Armenian-built product used by children abroad is also subject to the rules of each market it sells into. In the United States, the amended Children’s Online Privacy Protection Rule was published on 22 April 2025 (90 FR 16918), took effect on 23 June 2025 and has a general compliance date of 22 April 2026. In the EU, the GDPR sets its own age threshold for children’s consent to online services, which member states may vary. These rules need advice from counsel in each destination market; Armenian law does not displace them, and compliance with them does not satisfy the Armenian rules above.

For a wider comparison of the two regimes, see GDPR vs Armenian data protection rules. If your engineers also use AI coding assistants on customer projects, our guide on AI tools, customer contracts and data covers the supplier side. Before launch, map each data flow against the four questions above: who the data processor is, what the basis is, where the data go, and whether training is covered.

Frequently asked questions

Last updated: 20 October 2026