In such cases, the third party would be classed as a data processor on behalf of the school, for data protection purposes.
Mewn achosion o'r fath, byddai'r trydydd parti'n cael ei ddosbarthu fel prosesydd data ar ran yr ysgol, at ddibenion diogelu data.