Technical privacy assessment of Canvas LMS

I co-authored SURF’s sector-wide Data Protection Impact Assessment (DPIA) of Instructure’s hosted Canvas Learning Management System (LMS), with Valerija Kornilova. The assessment provides Dutch education and research institutions with a common framework for evaluating privacy risks in their use of Canvas. It focused on the SaaS learning platform and excluded Canvas Studio, Catalog, Credentials, and the processing of children’s data.

I led the technical analysis of data flows, service endpoints, platform features, and the vendor’s documented processing. The investigation considered support access, feedback, administrator masquerading, identity and access management, logging, analytics, AI features, APIs, cookies, anonymisation, subprocessors, data residency, and retention. It also examined data subject access request responses and compared observed network connections with Instructure’s subprocessor disclosures.

The DPIA identified three high, nine medium, and two low risks. The high risks concerned insufficient information in access-request responses, international transfers and data minimisation associated with Analytics and Google Cloud Looker, and the transparency of administrator masquerading. The report proposed measures for both institutions and Instructure. Following discussions, Instructure committed to measures including richer access-request exports, clearer documentation and user notices, API token controls, and other product and process changes. SURF’s December 2025 advice allowed institutions to continue using Canvas while applying the mitigations relevant to their own deployments.

SURF stated that it would retest the agreed measures in November 2026 and publish an updated assessment. Its accompanying article reported that some measures were already in place, with further commitments scheduled by the end of 2026. The assessment therefore records the negotiated risk position at publication and the planned verification; institutions remain responsible for applying the DPIA to their own use.