The ICO's guidance on AI says that "in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals' rights and freedoms". That is the legal trigger for a data protection impact assessment, done before the processing starts. Since 14 October 2026 the DfE's own data protection guidance has said as much, in a checklist that asks schools to carry out DPIAs for higher-risk processing involving AI tools, EdTech and monitoring technologies.
Children settle the question on their own. The ICO regards them as vulnerable because they may be less able to understand how their data is used or to protect themselves from the consequences. An AI tool plus pupils' data meets the test before anyone mentions SEND or a tool that scores and flags.
So the debate about whether a DPIA is needed is mostly over. The debate worth having is about who writes it, because that is where schools go wrong.
The DPIA belongs to the controller, which in the DfE's words is the school or the multi-academy trust. The ICO leaves each organisation to decide who carries it out and who signs it off. The division that works is simple: whoever proposes the tool drafts the DPIA, because they know what it is for; the DPO advises, and the law requires that advice to be sought and recorded, with reasons wherever it is not followed; a named senior leader or the headteacher decides and signs.
The common failure is the DPO doing all three. A DPO who drafts, advises and approves is marking their own homework, and the law gives the DPO the advising and monitoring role for a reason. Worth writing into the policy: the DPO is not the decision-maker on their own advice. The guide sets this out here: https://schoolaigovernance.co.uk/guides/dpia-for-ai-tools#who-holds-the-pen
The second failure is accepting the supplier's DPIA as the school's. The DfE's product safety standards expect generative AI products to have one, so ask for it and use it. It cannot replace the school's own, which covers these pupils, this purpose and this configuration. The ICO's audits of edtech providers, reported in June 2026, found that many had not done a DPIA at all where one was required, which is a reason to read theirs closely rather than file it.
The seven steps are the ICO's. For an AI tool, each has one question that matters more than the rest, and step two is where the real risks turn up: what goes in, where it is stored, who sees it, how long it is kept, and whether any of it becomes training data. Every "don't know" at step two becomes a written question to the supplier. The DfE says suppliers must be able to explain whether data is used to train the model, so the question to put in writing is this: is anything our staff or pupils put into your product, or anything it produces for us, used to train or improve your models or anyone else's, and which clause of our contract says so? The seven steps, with the AI question in each: https://schoolaigovernance.co.uk/guides/dpia-for-ai-tools#the-seven-steps-and-the-ai-question-in-each
A DPIA that stops a tool has worked. Most refusals are really "not like this": fewer pupils, no names, shorter retention, better terms.
And a DPIA describes the tool as assessed, which AI tools do not stay. The ICO calls it a living process; the DfE's procurement guidance says to keep it updated as and when the processing changes. The review triggers matter more than the annual date: a model or feature change, new terms, an incident, or any use beyond the one assessed. Where a tool needs no DPIA, a short dated screening note goes on file instead, because the ICO expects the reasons written down: https://schoolaigovernance.co.uk/guides/dpia-for-ai-tools#when-the-answer-is-no-and-keeping-it-alive
The guide, with every article, ICO page and DfE section cited and dated, is free: https://schoolaigovernance.co.uk/guides/dpia-for-ai-tools
The DPIA template for AI tools puts the ICO's seven steps as questions to answer, with the usual AI risks already listed. It is free to download, and it can be filled in on the page: https://schoolaigovernance.co.uk/templates/dpia-template
Wes Akram is an exams officer, data manager and DPO at a secondary school, and the author of The School AI Governance Handbook: for the slightly overwhelmed. Everything on schoolaigovernance.co.uk is free.
The facts behind this article
Every claim above is numbered to one of these records. Each gives the source’s own words where it can, the paragraph or section, and the date it was last read.
- 01
The ICO's AI guidance (updated 15 March 2023, under review) says that in the vast majority of cases the use of AI will involve processing likely to result in a high risk, so a DPIA is needed.
“in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals' rights and freedoms”
Guidance on AI and data protection: accountability and governance implications, accountability and governance implications. Dated 15 March 2023. Read 28 September 2026.
- 02
A DPIA is required before processing that is likely to result in a high risk to people's rights and freedoms, in particular where new technologies are used. It is not required before every tool that processes pupil data.
“in particular using new technologies”
UK GDPR, Article 35: Data protection impact assessment, Article 35(1). Read 28 September 2026.
- 03
The DfE's Data (Use and Access) Act 2025 compliance checklist for schools, published 14 October 2026 as a chapter of Data protection in schools, asks schools to carry out DPIAs where required, particularly for higher-risk processing involving AI tools, EdTech and monitoring technologies.
“carry out Data Protection Impact Assessments (DPIAs) where required, particularly for higher-risk processing involving”
Data protection in schools: Data (Use and Access) Act 2025 (DUAA): compliance checklist for schools, Children's data and safeguarding. Dated 14 October 2026. Read 8 November 2026.
- 04
The ICO regards children as vulnerable because they may be less able to understand how their data is being used, anticipate how it might affect them, and protect themselves against unwanted consequences.
“may be less able to understand how their data is being used, anticipate how this might affect them, and protect themselves against any unwanted consequences”
Data protection impact assessments (DPIAs) guidance, When do we need to do a DPIA?. Read 28 September 2026.
- 05
The ICO leaves each organisation to decide who carries out its DPIAs and who signs them off. The DPO's advice should be recorded on the DPIA, with the reasons if it is not followed; the reasons should be documented whenever a DPIA is judged unnecessary; and a DPIA is a living process.
“You should record your DPO's advice on the DPIA. If you don't follow their advice, you should record your reasons”
Data protection impact assessments (DPIAs) guidance, How do we do a DPIA?. Read 28 September 2026.
- 06
For most personal data in a school the controller is, in the DfE's words, the school or the multi-academy trust.
“the school or the multi-academy trust”
Data protection in schools, Responsibilities. Dated 9 July 2026. Read 8 November 2026.
- 07
The DPO's tasks include advising on and monitoring the DPIA, and the DPO's other tasks must not result in a conflict of interests. A DPO who drafts, advises on and approves the same DPIA is marking their own homework.
UK GDPR, Article 39: Tasks of the data protection officer, Article 39(1)(c); Article 38(6). Read 28 September 2026.
- 08
The standards expect a generative AI product to have had a data protection impact assessment, which a school can ask the supplier for; it does not replace the school's own DPIA.
Generative AI: product safety standards, privacy and data protection. Dated 19 January 2026. Read 28 September 2026. Still to be confirmed.
- 09
The ICO's audits of edtech providers, reported on 24 June 2026, found that in many cases providers had not done a DPIA at all where one was required, that some switched new features on by default, and that AI functionality had been introduced without adequate safeguards.
“hadn't done a DPIA at all where one was required”
Edtech examined (audit outcomes report), page 14. Dated 24 June 2026. Read 28 September 2026.
- 10
A section on procuring educational technology was added on 9 July 2026. It says a DPIA must be completed when processing is likely to result in a high risk, as early as possible, with the DPO's advice, and kept updated as and when the processing changes; suppliers must be able to explain how their tool works, including how AI outputs are moderated and whether data is used to train the model; the DPO and DSL must be consulted before purchase; and tools must be monitored after it.
“Suppliers must be able to explain how their tool works, including: how the AI (artificial intelligence) outputs are moderated; if the data is used to train the AI (artificial intelligence) model”
Data protection in schools: Procuring educational technology (EdTech), the section. Dated 9 July 2026. Read 28 September 2026.
- 11
The ICO's DPIA guidance carries the banner "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change", with no visible last-updated date. Re-check at launch.
Data protection impact assessments (DPIAs) guidance, every DPIA page. Read 28 September 2026.