How to do a DPIA for edtech in education
A DPIA guide and template approach for education: when colleges and training providers need a DPIA for edtech such as learner support software, and what to cover.
Glossary
What is a DPIA? Data protection impact assessment explained
A DPIA is a risk assessment you carry out before processing personal data that is likely to be high risk. When FE providers need one and what it should cover.
DPIA
Glossary term · 2 sources
Definition
A data protection impact assessment (DPIA) is a documented process, required by Article 35 of the UK GDPR, for identifying and reducing data protection risks before starting processing that is likely to result in a high risk to individuals. Learner support systems holding health and SEND data often need one.
A DPIA is a way of thinking about risk before you act. It helps you decide whether to go ahead, and with which safeguards.
When is a DPIA required?
Article 35 of the UK GDPR requires a DPIA where processing, taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of individuals. The Article gives examples, including large-scale processing of special category data, and the ICO publishes a list of processing types that always need one. New technology and processing of data about vulnerable people, such as children and young people with additional needs, are relevant factors. The ICO notes its guidance is under review following the Data (Use and Access) Act 2025, so check the current version.
If you are unsure, the ICO advises carrying out a DPIA as good practice. A DPIA is also useful for compliance records.
What does a DPIA contain?
The ICO outlines a process: describe the processing, its purposes and the data involved; consult the people involved, including the DPO and where appropriate those affected or their representatives; assess necessity and proportionality; identify and assess the risks to individuals; and identify measures to reduce them. Record the outcome and sign off, then review as things change.
How does a DPIA apply in FE and apprenticeships?
A system that records learner support plans, SEND information, mental health information, documents and reviews is likely to involve special category data, and the learners are often young and may be vulnerable. A DPIA is therefore sensible before adopting or substantially changing such a system. The college is the controller, so it carries out the DPIA, working with the supplier, who is normally a processor. For apprenticeships, consider the flow of data between provider, employer and others, and what the employer actually needs to see.
Our guide to a DPIA for learner support software goes through the questions, and the DPIA screening checklist helps you decide whether one is needed. Data protection officers can read more on the roles page.
What is a common misconception about DPIAs?
A DPIA is not a certificate that the supplier is safe, and it does not need to be finished before you speak to a supplier. It needs to be done before the processing starts. It is also not a one-off paper: it should be reviewed when the processing, risks or suppliers change. Finally, a DPIA is not a way to avoid risk altogether. Its purpose is to show that risks were identified and sensibly handled.
Where can you find the official source?
Read Article 35 of the UK GDPR on legislation.gov.uk and the ICO’s DPIA guidance. This is general information and not legal advice, so consult your data protection officer on particular systems.
Frequently asked questions
Who is responsible for carrying out a DPIA?
The controller, which is usually the college or training provider, is responsible. A software supplier acting as processor should help with information, but cannot do the DPIA for the controller.
Should the DPO be involved?
Yes, where you have a data protection officer, you must seek their advice when carrying out a DPIA, and record it.
What if the DPIA shows a high risk that cannot be reduced?
You must consult the ICO before starting the processing.
Sources and further reading
Official guidance changes. Check the source before relying on any detail, and take professional advice for individual cases.
Help shape the pilot
We are working with a small number of England FE colleges and apprenticeship providers first. Tell us about your learner support and we will be in touch.