Inclusion Studio
Contact Join the pilot
Menu

Free tool

DPIA screening checklist for education

Screening questions based on ICO guidance to help FE providers decide whether learner support software is likely to need a DPIA. Free, private, not legal advice.

Free tool Updated

Tool at a glance

  • Runs entirely in your browser
  • Nothing is sent or saved
  • Copy, print or download the result
  • Free, no sign-up
Start using the tool
In short

This free checklist asks screening questions based on UK GDPR Article 35 and ICO guidance, then tells you whether a data protection impact assessment (DPIA) looks required or likely for learner support software, with the reasons. It is not legal advice: confirm the outcome with your data protection officer and the ICO’s current guidance.

Private by design. This tool runs entirely in your web browser. Nothing you type is sent to Inclusion Studio or anyone else, and nothing is saved: refreshing or closing the page clears it. If you plan to print or share the result, use a first name or initials rather than full personal details.

A data protection impact assessment (DPIA) is how you identify and reduce the data protection risks of a new system before you use it. UK GDPR requires one when processing is likely to result in a high risk to people’s rights and freedoms. This checklist walks through the screening questions the ICO describes, so you can see whether new learner support software is likely to need one, and why.

Not legal advice. This is a screening aid based on our reading of UK GDPR Article 35 and ICO guidance at the time of writing. Guidance changes. Verify the outcome against the ICO’s current guidance and agree it with your data protection officer.

Screen your processing

Optional. For example “New learner support platform for ALS team”.

Part 1: Processing that always needs a DPIA

UK GDPR Article 35(3) lists three types of processing that always need a DPIA.

Will the software be used for systematic and extensive evaluation of learners, including profiling, that leads to decisions with legal or similarly significant effects on them?

For example, automatically deciding whether a learner is eligible for support or funding.

Will it process special category data, such as health or disability information, or criminal offence data, on a large scale?

Consider the number of learners, the amount of data, how long it is kept and how widely it is used.

Will it involve systematic monitoring of a publicly accessible area on a large scale?

For example, large-scale CCTV. Rare for learner support software.

Part 2: The ICO’s list of processing likely to be high risk

The ICO publishes a list of processing that needs a DPIA. Some items apply only in combination with one of the criteria in part 3.

Does it use innovative technology, or a new use of existing technology, such as AI drafting or analysis?

The ICO lists innovative technology, including AI, as likely high risk when combined with one of the European criteria below.

Will it be used to make decisions about a learner’s access to support, a service or an opportunity, where those decisions rely on automated decision-making or profiling, or involve special category data?

Decisions about learner support usually involve health or disability information.

Will it profile learners on a large scale?

For example, risk ratings or predictions applied across all learners.

Will it process biometric data, such as facial recognition or fingerprints?

Including for sign-in or identity checks.

Will it process genetic data?

Very unlikely for learner support software.

Will it combine, compare or match personal data from several sources?

For example, importing from your student records system, EHCPs from local authorities, or information from employers.

Will you obtain personal data from someone other than the learner where giving them privacy information would be impossible or take disproportionate effort?

Known as invisible processing.

Will it track learners’ location or behaviour, including online activity?

For example, detailed activity monitoring or location data.

Will it use the data of children or other vulnerable people for profiling or automated decisions, or offer an online service directly to children?

Many FE learners are under 18. A learner portal may count as an online service offered directly to them.

Could a data breach put someone’s physical health or safety at risk?

For example, if records include safeguarding information or the address of a learner at risk of harm.

Part 3: The nine European criteria

The ICO refers to nine criteria from European guidance. Meeting two or more usually indicates a DPIA is needed.

Does it involve evaluating or scoring learners?

Including risk ratings or predicted needs.

Does it make automated decisions with legal or similarly significant effects?

Decisions made without meaningful human involvement.

Does it involve systematic monitoring of learners?

For example, ongoing monitoring of attendance, behaviour or activity.

Does it process sensitive data or data of a highly personal nature?

Health, disability, safeguarding, care experience and support needs all count.

Is the data processed on a large scale?

Consider the number of learners, volume of data, duration and geographical spread.

Does it match or combine datasets?

From different systems or organisations.

Does it concern vulnerable people?

Children, disabled learners and others who may find it harder to exercise their rights.

Is it an innovative use of technology, or a new technological or organisational solution?

For example, AI features or a new way of sharing records with employers.

Could it prevent learners from exercising a right or using a service?

For example, if the system’s output affects whether support is offered.

How does the screening work?

The checklist follows the structure of the ICO’s guidance on when a DPIA is needed:

  1. Part 1 covers the three types of processing that UK GDPR Article 35(3) says always need a DPIA.
  2. Part 2 covers the ICO’s published list of processing likely to result in high risk. Some items, such as innovative technology and tracking, need a DPIA when combined with at least one of the European criteria in part 3. Others need one on their own.
  3. Part 3 covers the nine criteria from European guidance that the ICO refers to. As a rule of thumb, processing that meets two or more is likely to need a DPIA, although the ICO says this is not a strict rule and one may be enough.

The tool shows which answers led to the outcome, and lists anything you marked “not sure” so you can find out before deciding.

Why does learner support software often need a DPIA?

Learner support records are some of the most sensitive information a college or training provider holds. They often include health and disability information, which is special category data under UK GDPR. Many learners are under 18, and many are disabled, so they may count as vulnerable data subjects. Support systems also tend to combine data from several sources, such as your student records system, transition information and EHCPs. Each of these is one of the criteria the ICO uses, so a full DPIA is common. The guide to special category data in education explains the extra conditions that apply.

Even where a DPIA is not strictly required, the ICO describes it as good practice for any major project involving personal data. A well-done DPIA also helps you set the system up well: who can see what, how long records are kept and what the supplier does with the data.

What should a DPIA for learner support software cover?

The ICO’s guidance sets out what a DPIA must contain. For learner support software, the practical questions usually include:

  • What data will be collected, from whom, and why each item is needed.
  • Your lawful basis and, for health and disability data, the additional condition for processing special category data.
  • Who can see which information, including tutors, assessors and apprenticeship employers, and how access is enforced.
  • Where the data is stored and processed, which subprocessors are involved and whether any data leaves the UK.
  • How AI features, if any, are used, whether they are optional and how a person reviews outputs.
  • Retention periods, deletion and how learners can exercise their rights.
  • Security measures, incident response and how risks will be reduced.

The guide to DPIAs for learner support software goes through these in more detail.

What are the limits of this checklist?

It is a screening aid, not a DPIA. It cannot judge whether your processing is “large scale” or whether your risks are mitigated, which depend on your specific circumstances. It reflects our reading of ICO guidance, which may change. It is not legal advice. Always involve your data protection officer, and use the ICO’s own guidance and template. If a DPIA shows a high risk that you cannot reduce, UK GDPR requires you to consult the ICO before starting the processing.

How does Inclusion Studio approach this?

Inclusion Studio is learner support software in development and currently uses synthetic data only. Its primary application database is hosted in London, and the supporting services it uses will be documented and assessed before any real learner data is used. That information is intended to help pilot partners with their own DPIA. See data protection and where data is processed.

Frequently asked questions

Does learner support software always need a DPIA?

Not automatically, but it often will. Learner support records usually include health and disability information about young and vulnerable people, which meets several of the criteria the ICO uses. Your data protection officer should make the final call and record the reasons.

Who is responsible for the DPIA: the college or the software supplier?

The controller, which is usually the college or training provider, is responsible for carrying out the DPIA. The supplier, as processor, should help by providing information about how the software works, where data is processed and how it is secured.

When should we do the DPIA?

Before the processing starts. In practice that means before you put real learner data into a new system, and ideally early enough that the findings can shape how you set it up.

What if we decide a DPIA is not needed?

Record the screening decision and your reasons. The ICO says you can decide not to do a DPIA if you are confident the processing is unlikely to be high risk, but you should document why. Revisit the decision if the processing changes.

Sources and further reading

Official guidance changes. Check the source before relying on any detail, and take professional advice for individual cases.

Want this as a joined-up process?

Inclusion Studio is learner support software in development for England FE colleges and apprenticeship providers. We are looking for pilot partners to shape it with us.

Join the pilot How it works