European schools are increasingly relying on vendors to collect, process, analyse, and even make decisions based on a considerable amount of student data through big data tools and methods. Consequently, portions of school’s power are gradually shifting from traditional public schools to the hands of for-profit organisations. This article discusses the current and forthcoming European Union (EU) data protection regime with respect to the protection of student rights from the potential risk of outsourcing student data utilisation in Kindergarten-12th grade (K-12) educational systems. The article identifies what lessons can be drawn from recent developments in the United States (US) “student data affair”. These lessons can provide a new perspective for designing a balanced policy for regulating the shift in school’s power.