If you're introducing an AI tool that touches personal data, you probably need a DPIA. Here's when one is required and how to work through it without it becoming a term-long project.
When is a DPIA required?
A DPIA is required where processing is likely to result in high risk to individuals. For AI in schools, that typically means: any tool processing pupil personal data, anything involving children's data at scale, tools using new technology in ways pupils and parents wouldn't expect, or anything touching special category data such as SEND or health information.
Given AI is new technology and children are considered vulnerable data subjects, the safe assumption is that a pupil-facing AI tool needs one. Your DPO decides — ask early rather than late.
The shortcut worth knowing: if no personal data goes into the tool at all — staff working generically as we recommend throughout — then there may be no processing of personal data to assess. That's precisely why the "work generically" rule is so valuable: it sidesteps a great deal of this. Confirm with your DPO, but many staff-only AI uses fall here.
Working through the DPIA
1. Describe the processing
What the tool does, what data goes in, who can access it, where it's stored, how long it's kept, and who the provider is. Be specific — vagueness here undermines everything after it.
2. Explain necessity and proportionality
Why you need this tool, why it's proportionate, your lawful basis, and whether a less intrusive option would achieve the same. "It saves teachers time" is a legitimate answer if honestly argued.
3. Consult
Your DPO must be consulted. Consider also asking staff who'll use it, and — where pupil-facing — think about parent and pupil views. Record what you did.
4. Identify the risks
Realistically: data leaving your control, staff entering more than intended, provider using inputs for training, retention beyond need, inaccurate output affecting a child, and unauthorised access.
5. Set out the mitigations
For each risk, what reduces it — the staff rules, training, technical controls, contractual terms, monitoring, and the review cycle.
6. Sign off and review
Record the residual risk and who accepted it, and set a review date. If high risk remains unmitigated, the ICO must be consulted before proceeding.
Practical pointers
- Start it before you buy, not after rollout
- Ask the provider directly — many publish DPIA support material
- Use your existing template rather than inventing an AI-specific one
- Keep it proportionate to the actual risk
- It's a live document — revisit when the tool or your use changes
- MATs can do one centrally — see MAT AI steering groups
The honest caveat
We're not lawyers or DPOs and this isn't legal advice — your DPO owns this and their view governs. What we can say is that schools who involve their DPO early find this straightforward, and schools who introduce a tool first and ask afterwards often find it painful. See AI and GDPR in schools.
Need help getting AI past your DPO?
We help schools prepare the groundwork so approval is straightforward. AskColin gives schools low-cost monthly support with one-to-one help whenever you need it — so when you're stuck on a real job at 8am, there's someone to ask. Practical, jargon-free, built around your team.
Get one-to-one AI support for your schoolFrequently asked questions
When does a school need a DPIA for AI?
Where processing is likely to result in high risk — typically any tool processing pupil personal data, anything involving children's data at scale, new technology used in unexpected ways, or anything touching special category data like SEND or health. Assume a pupil-facing AI tool needs one and ask your DPO early.
Do you need a DPIA if no personal data goes into AI?
Possibly not — if staff work generically and no personal data enters the tool, there may be no processing of personal data to assess. That's a key reason the 'work generically' rule is so valuable. Confirm with your DPO, but many staff-only uses fall here.
What should an AI DPIA include?
A specific description of the processing, necessity and proportionality with your lawful basis, evidence of consultation including your DPO, identified risks such as data leaving your control or inaccurate output affecting a child, mitigations for each, and recorded sign-off with a review date.
When should a school start a DPIA?
Before purchasing, not after rollout. Schools that involve their DPO early find the process straightforward; those that introduce a tool first and ask afterwards often find it painful and occasionally have to withdraw it.