DPIA template
A data protection impact assessment for your school to complete, with our part already filled in.
Download as PDF (version 1.3)
A data protection impact assessment (DPIA) helps your school spot and reduce the risks of using a service that holds personal data about pupils. The Absolute Education Data Processing Agreement recommends one, because the Absolute Education Enrichment Tracker can hold SEN, ethnicity, medical, care and disadvantage indicators about children.
We have filled in what we know about the Service. Your school completes the empty boxes, usually with its data protection officer (DPO), and keeps the finished copy with its records. It follows the shape of the ICO’s DPIA guidance. If you need any more detail from us, email info@absolute-education.co.uk; we help with DPIAs at no extra cost.
Topics
1. About this assessment
| School | |
|---|---|
| Completed by (name and role) | |
| Date completed | |
| Next review |
Why a DPIA is needed
The Service processes personal data about children, and can include special category data (SEN status, ethnicity, dietary needs and medical conditions) and indicators of disadvantage (Pupil Premium, free school meals, care status, young carers). The ICO expects a DPIA where processing involves vulnerable people or special category data. Review this assessment if your school starts recording more data in the Service, or uses it in a new way.
2. The processing
| Item | Detail |
|---|---|
| Service | Absolute Education Enrichment Tracker |
| Supplier (processor) | Absolute Education LTD, 40 Greenway Avenue, Taunton, Somerset, TA2 6HY. Company number 15413409, ICO registration ZB757620. |
| What the supplier does with the data | Collection (manual entry, Excel upload, Wonde sync), storage, organisation, analysis, reporting, export and deletion |
| Where the data is held | United Kingdom |
| Sub-processors | DigitalOcean – Server hosting and backups (United Kingdom); MailerSend – Sending service emails to staff, such as account emails and links to scheduled reports. Emails are not used to send pupil data (Belgium (EU), on Google Cloud) |
| Other suppliers | Wonde Ltd acts under its own agreement with the School and is not a sub-processor of Absolute Education. |
| Agreement in place | The Absolute Education Data Processing Agreement (UK GDPR Article 28) |
| For the School to complete | Answer |
|---|---|
| Which staff will use it, and for what | |
| How pupil data gets in (Wonde, upload or typed in) |
3. Scope
| Item | Detail |
|---|---|
| People the data is about | Pupils of the School; staff named as activity leads |
| Pupil data | First name, surname and initials, and legal names where synced from the School's MIS, Year group, Class / registration group, House group, Gender, Unique pupil number (UPN), admission number, and the Wonde and MIS pupil identifiers, First language, Permissions from the School's MIS, synced through Wonde: whether the pupil may be photographed or go on school visits, and where their photo may be used, Enrichment participation and attendance records, Engagement ratings given by staff in registers, where the School turns this on, Transport and wrap-around care arrangements for activities (pick-up, walking home, wrap-around care), and whether a parent has given permission for an activity, recorded by School staff, Notes added by School staff, Support documents uploaded by School staff against a pupil, which may contain special category data. These are deleted once the academic year they were uploaded for ends |
| Context indicators | Pupil Premium status, Free school meals (current, Ever 6 and FSM type), EAL status, Service child status, Looked after and Ever in Care status, Gifted and talented and more able status, Young carer status (the pupil cares for someone at home), where recorded by School staff |
| Special category data | SEN status (health-related); ethnicity; dietary needs (which can reveal health or religion); and medical conditions shared through Wonde (the condition, its severity, symptoms, triggers, treatment, emergency procedure and notes), so staff running an activity know how to keep the pupil safe. Only to be recorded where the School has an Article 9 condition |
| Wonde data | Only the fields listed above are stored, whatever else the School allows in its Wonde data request. SEN status, ethnicity, dietary needs and medical conditions are only synced where the School includes them, and medical conditions are deleted if the School stops sharing them |
| How long it is kept | While the School subscribes, the School decides: it can delete pupils or archive leavers at any time. When the subscription ends, data is deleted from live systems within 30 days and from backups within a further 30 days. |
| For the School to complete | Answer |
|---|---|
| Roughly how many pupils, and which year groups | |
| Which of the optional fields above the School will record, and which it won’t | |
| How long the School will keep records of leavers |
4. Context
The data is about children, who may not understand how it is used, so it needs extra care. The School controls what is recorded and who can see it; Absolute Education only acts on the School’s instructions and never sells the data or uses it for marketing.
| For the School to complete | Answer |
|---|---|
| How pupils and parents are told (for example, the School’s privacy notice) | |
| Any concerns raised, or past issues with similar systems |
5. Purpose and lawful basis
Our purpose: to provide the Service to the School and produce participation statistics. Schools use these statistics to see who takes part in enrichment and to support pupils who miss out.
Most state schools rely on public task (Article 6(1)(e)). For SEN status, ethnicity, dietary needs and medical conditions, schools usually rely on Article 9(2)(g), substantial public interest, with a condition from Schedule 1 of the Data Protection Act 2018. Independent schools may rely on legitimate interests instead. Check with your DPO.
| For the School to complete | Answer |
|---|---|
| What the School wants to achieve (for example, Pupil Premium or SEN participation) | |
| Lawful basis (Article 6) | |
| Condition for SEN status, ethnicity, dietary needs and medical conditions (Article 9), if recorded | |
| Why each field recorded is needed, and could less be used? |
6. Risks and how they are reduced
We list the main risks and what is already in place. Your school rates each risk with those measures in place, and adds anything else it will do. A common scale is likelihood (remote, possible, probable), severity (minimal, significant, severe) and overall risk (low, medium, high).
| Risk | Already in place | Likelihood | Severity | Overall |
|---|---|---|---|---|
| Someone gets into pupil records who shouldn’t, for example through a stolen staff login or an attack on the Service. | Each school sees only its own data. The security measures in Schedule 3 of the DPA cover certification, encryption, access control, staff access, resilience, monitoring and people. Absolute Education tells the School about any breach within 24 hours. | |||
| Staff see SEN, ethnicity, medical, dietary or disadvantage indicators they don’t need. | School admins manage which staff have accounts. The “Student demographics” register setting hides SEN, EAL and Pupil Premium tags from registers. The School chooses which fields to record or sync. | |||
| Records are wrong or out of date, for example an old SEN status. | Where the School uses Wonde, pupil details stay in step with its MIS. Staff can correct or delete records at any time. | |||
| Data is kept longer than needed. | The School can delete pupils and archive leavers. Support documents uploaded against pupils are deleted once the academic year they were uploaded for ends. At the end of the subscription, data is deleted within 30 days and purged from backups within 30 days, with written confirmation on request. | |||
| Data goes to other organisations or leaves the UK. | Data is held in the United Kingdom. Only the sub-processors in section 2 are used, under written contracts, with 30 days’ notice of any change (less only where a replacement is urgent, with the School told as soon as possible). Data is never sold or used for marketing. Scheduled reports are emailed as a link, not a file: recipients are the School’s own staff (and our site admins), who sign in to download them, so the report stays on our UK servers. | |||
| Pupils or parents can’t use their rights, such as seeing or correcting their data. | Absolute Education passes on any request within 3 working days and provides exports within 5 working days, so the School can meet its one-month deadline. | |||
| Any other risk the School has identified: |
| For the School to complete | Answer |
|---|---|
| Further steps the School will take, for example staff training or limiting who has an account |
7. Sign-off
| Item | Name and date | Notes |
|---|---|---|
| Remaining risks approved by | If any high risk remains, the School must consult the ICO before going ahead. | |
| DPO advice given | Summary of the DPO’s advice: | |
| DPO advice accepted or overruled | If overruled, say why: | |
| This DPIA will be kept under review by |