A Danish municipality deployed Google Chromebooks and G Suite for Education in its municipal schools without conducting required risk assessments or ensuring proper privacy configurations. Consequently, the personal data of pupils was processed in violation of the GDPR, exposing them to risks of unauthorized data profiling and sharing. The Danish Data Protection Authority issued a serious criticism against the municipality and ordered it to bring its data processing practices into compliance.