Learner support software for data protection officers

Learner support records often include health, disability and other special category data, about young people and adults. As a DPO you must advise on whether a tool is appropriate. This page sets out what Inclusion Studio can tell you today, what is still to be assessed and where to find the detail. It is not legal advice.

What does a DPO’s day look like?

You handle subject access requests, breach reports, data sharing questions, procurement reviews and DPIAs, often while covering several other roles. When a new learner support tool is proposed, the questions are familiar: what data, whose, why, where, who else sees it, for how long, and what happens when something goes wrong.

What do DPOs need to know about learner support software?

• A clear description of the data and purposes.
• A named list of processors and where they process data.
• An honest account of controls: access, storage, logging, retention.
• The material to carry out a DPIA.
• No overclaiming.

What data does Inclusion Studio hold?

By design it holds the learner support record: requests, what helps in the learner’s words, support plans, delivery and review records, learner feedback, documents the provider uploads, and minimal identity and role details for staff and learners. Much of this is special category data. See special category data in education and the glossary entry on special category data. Your organisation, as controller, decides the lawful basis and the condition for processing. See the entries on controller and processor and UK GDPR.

Where is data processed?

The primary application database is hosted in London, on Neon (AWS eu-west-2). We do not claim that all data stays in the UK, or that the platform is UK-only. Supporting services may process data elsewhere, for example sign-in, hosting, file storage, logs, email and telemetry, and each is to be documented and assessed before real learner data is used. See where data is processed and subprocessors. If you need strictly UK-only processing, ask us early, because it would be a separate decision.

How is access controlled?

Permissions are enforced on the server by organisation, relationship and field. Hiding a button is never the safeguard. Employers of apprentices see only workplace adjustments and their own actions, never the full learner history. Sign-in uses Clerk, and privileged staff accounts are intended to require multi-factor authentication. Tenant and permission data lives in our own database, and Clerk holds only minimal identity data, never diagnoses, SEND details or case notes. See permissions and roles and security.

How are documents handled?

Uploaded documents go to private storage and are released only to authorised people. Untrusted uploads are quarantined until scanned. The scanning provider is still to be chosen, so treat this as a pre-live dependency, not a finished control. See documents.

How does AI affect data protection?

AI is optional and human-reviewed, and the full journey works without it. Drafts are labelled, and a person reviews before saving. AI never diagnoses, refuses support, decides, shares externally or is trained on case records. Gemini on Google Cloud Vertex AI is the selected AI provider. It has been exercised with synthetic data only, in a preview environment, at an EU multi-region endpoint accepted for preview use. Where real learner data would be processed is not decided, the live application uses a mock, and no real learner data has been sent to any AI provider. Retention and training terms for real data will be documented and assessed before any real record is processed. See AI principles, AI drafts and using AI safely in learner support.

What should a DPO do before adoption?

1. Complete a DPIA. See DPIA for learner support software and the DPIA screening checklist.
2. Review the processor list and contract terms, including any international transfers.
3. Define retention, export and deletion for records and documents.
4. Decide how learners are informed, and how rights requests are handled.
5. Agree incident roles and contacts. See responsible disclosure.

What questions should a DPO put to any supplier?

A few questions are worth asking about this product and any other. Which categories of data are processed, and for what purposes? Who are the processors and sub-processors, and where do they process data? What access does the supplier’s own staff have to customer records, and how is it logged? How are subject access, rectification, retention and deletion handled across the database, files and any derived data? What happens in an incident, and how fast will you be told? Our answers are given on the trust pages as they are verified, and where something is not yet decided we say so rather than guess.

What is the current status?

Inclusion Studio is pre-pilot, with synthetic data only. We have no customers, no certifications and no completed independent security review. See the assurance roadmap for what is planned, and the data protection page for the current position. For questions, contact us. For the technical picture, see IT and systems. The trust centre brings all of these documents together.