Data protection pack for schools
Everything your data protection officer needs to approve Assess Plan Do Review, ready to download.
Before a school starts using a new tool, its data protection officer (DPO) usually needs to see how pupil information is handled and complete a data protection impact assessment (DPIA). We've done most of that work for you. Assess Plan Do Review stores no pupil information and sends no pupil information anywhere, so the assessment is short.
Word document · 7 pages
Ready-filled DPIA template
Follows the ICO's DPIA template. We've filled in how the product works, the data involved, the risks and the measures that reduce them. You add your school's details, lawful basis and sign-off in the highlighted spaces.
PDF · 1 page
Security and data protection summary
One page for your DPO, IT lead or governors: what we hold, what leaves the browser, hosting and transfers, technical security, retention and who is responsible for what.
The key facts
- No pupil data is stored or sent. What staff type is held in the browser's memory only while the page is open, and disappears when it is closed or refreshed.
- Staff accounts only. For school logins we hold staff names, school email addresses and scrambled passwords, in Cloudflare's Western Europe region.
- Your school stays in control. The school is the controller of everything staff enter and the plans they print or download. Because we never receive pupil information, we don't act as a processor for pupil data.
- No AI, analytics or tracking. No profiling or automated decisions. Staff choose and edit everything.
- Imported documents stay on the device. EHCPs, reports and behaviour logs are read in the browser and never uploaded.
- We'll tell you first. If the product ever changed in a way that meant storing or sending pupil information, we would tell you beforehand and agree a data processing agreement.
More detail
Our privacy statement explains everything in full, including the questions data protection officers ask. Our terms of service cover licences, data deletion and liability.
If your DPO has a question that isn't answered here, or uses their own DPIA or supplier questionnaire, email [email protected] and we'll complete it for you, usually within two working days during term time.