Boxfish Labs helps educators, schools, universities, training providers, learning teams, and education-focused organisations build safer digital habits, protect personal data, reduce human cyber risk, and use technology and AI with greater confidence.
Education depends on trust. Learners, families, educators, staff, and partners need to trust that personal information is handled responsibly, digital platforms are used safely, and learning environments support confidence rather than fear.
At the same time, education is becoming more digital, connected, and data-intensive. Learning platforms, collaboration tools, student records, assessment systems, research data, remote learning, cloud services, AI assistants, and third-party apps create powerful opportunities -but also new privacy, security, safeguarding, and resilience responsibilities.
Boxfish Labs helps educators make those responsibilities practical. We combine engaging cybersecurity and privacy learning with expert advisory, data-protection support, and governance guidance. Our human-centred approach helps people build skills they can use in everyday life, while enabling education organisations to strengthen trust, reduce risk, and meet their obligations.
Security awareness in education should not be a technical lecture, a punitive phishing test, or a policy people are expected to read once. Learners and staff build safer habits when they understand the real situation, can practise decisions, feel able to ask questions, and see how digital safety connects to their own goals and wellbeing.
A human-centred approach helps education organisations:
We create engaging learning around phishing, scams, password and account protection, privacy, data sharing, social engineering, secure collaboration, misinformation, AI use, incident reporting, and digital wellbeing.
We replace one-off, slide-based compliance training with behaviour-focused microlearning, interactive workshops, simulations, serious games, cyber escape rooms, and practical scenarios that people can discuss and apply.
We support privacy governance, data-flow mapping, records of processing, privacy notices, vendor review, DPIAs, data rights, retention, incident response, and External DPO support where appropriate.
We help identify AI use cases, data and provider dependencies, privacy and security risks, human-oversight needs, transparency expectations, and practical governance aligned with the EU AI Act and responsible education practice.
We map data, systems, vendors, access, contracts, transfers, hosting, third-country exposure, and critical dependencies so you can make more informed technology and procurement decisions.
We help translate rules into usable guidance for educators, administrators, IT teams, researchers, student-support teams, and leadership -so people know what to do when handling data, using platforms, adopting AI, or responding to a concern.
We support incident readiness, reporting culture, response roles, communication, business continuity, recovery, and learning after disruption -helping the organisation protect people and maintain important services.
We provide Information Security Advisory or External CISO support to establish governance, risk management, policies, supplier oversight, security controls, awareness, evidence, and a roadmap that fits the education context.
Identify learners, staff, partners, information types, learning activities, platforms, AI tools, data flows, suppliers, access patterns, and the trust or safeguarding concerns that matter most.
Assess the human, privacy, security, supplier, technology, AI, governance, and continuity risks that could affect learners, staff, data, delivery, or institutional trust. Clarify who owns decisions and escalation.
Establish proportionate policies, privacy practices, access controls, vendor checks, incident processes, reporting routes, learning materials, evidence, and governance routines that support real work.
Deliver engaging awareness experiences tailored to learners, educators, administrators, technical teams, or leadership. Reinforce safer habits through scenarios, simulations, reflection, communication, and accessible follow-up resources.
Use feedback, participation, reporting patterns, incidents, supplier changes, new tools, AI adoption, and evolving needs to improve your programme over time.
Short, focused learning that fits into busy teaching, learning, and administrative routines. Topics can be tailored to roles, age groups, tools, and risks.
Facilitated sessions that help people discuss realistic decisions: suspicious messages, data sharing, secure remote learning, AI use, incident reporting, student privacy, or social engineering.
Interactive, collaborative formats that turn cybersecurity and privacy concepts into memorable problem-solving experiences. Suitable for team development, student engagement, awareness events, and learning programmes.
Ethical simulations and targeted microlearning that help participants recognise suspicious messages, improve reporting, and learn without fear or public shaming.
Support trusted people in departments, schools, communities, or learning teams to reinforce safer practices, collect feedback, and connect security guidance to everyday reality.
Learning that connects security and privacy with healthier online habits, attention, misinformation resilience, inclusion, AI literacy, critical thinking, and responsible participation in digital life.
Yes. Learning can be designed for learners, educators, administrative staff, IT teams, leaders, parents, volunteers, and wider communities. The format, language, examples, and safeguarding approach should be adapted to the participants and setting.
No. We work with education providers, training organisations, EdTech companies, learning and development teams, libraries, youth organisations, nonprofits, and other groups that help people learn and use technology safely.
Yes. A human-centred programme should reflect participants’ context. We can tailor language, scenarios, accessibility, interaction style, tools, length, and learning outcomes for different audiences and levels of experience.
Yes. We can support AI inventory, risk assessment, privacy and data review, provider and data-flow questions, human oversight, transparency, staff guidance, learner-facing information, and responsible-use practices aligned with relevant EU AI Act and GDPR considerations.
Yes. External DPO and privacy advisory support can cover personal-data mapping, records of processing, DPIAs, privacy notices, vendor agreements, international transfers, data rights, retention, incidents, and privacy-by-design.
Yes. Depending on the audience and format, learning can be delivered remotely, in person, or as a hybrid programme. We select the approach that works best for participants, objectives, locations, and available time.
Tell us about your learners, staff, platforms, data, AI plans, or digital-safety concerns. We will help you identify a practical programme that strengthens confidence, privacy, and resilience.
