Instructor Data Access

What it is

When you take a course, the instructor can see that you are enrolled, how far you have progressed, your quiz scores, and any questions or forum posts you submit.

Why it matters (compliance & governance perspective)

The clause establishes the operational scope of instructor access to student performance data and course participation records, defining what institutional visibility instructors have into their students' engagement and assessment outcomes.

Consumer impact (what this means for users)

Your enrollment status, course progress, quiz results, and any course forum posts or questions are accessible to the individual instructor delivering the course, which may affect what information you choose to share in course interactions.

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: This data-sharing arrangement involves Udemy disclosing learner personal data (including assessment performance and communications) to individual instructors who may be independent contractors rather than employees. Under GDPR, this may constitute a disclosure to a third party requiring a documented lawful basis; the policy's transparency about this practice supports reliance on contractual necessity or legitimate interest, but the legal basis should be documented. FERPA considerations arise if Udemy is used in accredited educational settings where instructor-student records may be subject to that framework. 2. GOVERNANCE EXPOSURE: Low-Medium. Sharing performance data with instructors is operationally necessary for a learning platform and is disclosed in the policy. Governance exposure arises primarily in cases where instructors are not adequately bound by data protection obligations through their agreements with Udemy, particularly for sensitive learning data such as assessment results. 3. JURISDICTION FLAGS: EU/EEA users' assessment and participation data being shared with instructors who may be located outside the EEA raises potential cross-border transfer questions depending on instructor location. FERPA applies in accredited educational institution contexts. The UK Children's Code is relevant where courses are accessed by users under 18. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise clients deploying Udemy Business should assess whether course instructors (particularly third-party instructors) have appropriate data protection agreements with Udemy that govern their access to enterprise employee learner data. This is a sub-processor or third-party controller question that should be addressed in the DPA. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that Udemy's instructor agreements include data processing obligations and restrictions on secondary use of learner data. Users and organizations should be aware that deleting a Udemy account may not retroactively remove data already disclosed to instructors.

Applicable agencies

Provision details

Other risks in this policy

• Udemy Business Employer Data Sharing high
• Third-Party Advertising and Analytics Data Sharing medium
• Data Sharing in Merger or Acquisition medium
• California CCPA/CPRA Rights low
• Cross-Border Data Transfers (EU-U.S. Data Privacy Framework) medium
• Children's Privacy and Age Restriction medium