Educational Data Mining (EDM) enables institutions to analyze student data to improve learning outcomes, but this potential must be balanced with data privacy regulations such as the European Union's General Data Protection Regulation (GDPR), which primarily applies to EU residents but influences global data practices. This paper examines how GDPR shapes EDM practices by analyzing key principles, such as lawfulness, purpose limitation, and data minimization, and the challenges they create in educational contexts. We highlight common tensions between regulatory compliance and innovation, including difficulties with consent management, data retention, and the trade-offs of anonymization techniques. Drawing on selected examples from higher education institutions and digital learning platforms, we show strategies adopted to align with GDPR requirements. Our findings suggest that while institutions are developing adaptive governance models, issues such as consent timing, reidentification risks, and limited resources continue to hinder effective EDM. We conclude by proposing future directions for privacy-preserving analytics, dynamic consent frameworks, and collaborative policymaking to support responsible data use in education.