The pattern is always the same. A teacher finds a tool, it works, word spreads, and by half term four classes are using it and nobody has asked where the data lives.
What a DPIA actually is
It is a structured set of questions about what data a system will process, why, and what could go wrong. For most classroom tools it is a twenty-minute exercise, not a project.
The questions worth asking first
- What personal data does it collect, and does it need all of it?
- Where is that data stored, and is it outside the UK?
- Who at the supplier can see it?
- What happens to it when we stop using the tool?
If the answer to any of those is "we do not know", that is the finding — and it is a much cheaper finding now than after a breach.
