DPIA template for AI tools
Section 8 of the AI policy.
The document opens on the page; press each bracket and type what goes there, and the finished Word file downloads at the end. Nothing is stored unless you save it to your account.
Download
- Word document (DOCX, 14 KB)
- PDF (PDF, 80 KB)
A4 portrait, three pages.
Free to use, adapt and share in education, under CC BY-NC-SA 4.0. No sign-up, no email address. Files are rebuilt from the text on this page at every deploy, so what you download is what you read.
The file, as text
¶ DPIA for AI tools · Appendix B · [School name]
Data protection impact assessment for an AI tool
The ICO's seven steps, phrased as the questions to answer, with the AI-specific prompts built in. One completed copy per tool, linked from its row in the Approved Tools Register. The DPIA belongs to the school as controller: whoever proposes the tool drafts it, the DPO advises and that advice is recorded, and a named senior leader decides.
Tool, proposer, date: [name and version of tool] · [person introducing it] · [DPO advising] · [date started]
Step 1: the need #
What is proposed, in two or three sentences, and why a DPIA is required. For an AI tool used with pupils' data the answer is usually that AI is an innovative technology and children are vulnerable data subjects, which together meet the ICO's high-risk test. If you conclude no DPIA is needed, record why here and stop: the record is the point.
Step 2: the processing #
What data goes in (list it exactly). Where it is processed and stored. Who can see it. How long it is kept. What comes out. Whether inputs train the supplier's models. Whether names can be left out (use pseudonyms or candidate numbers where possible). Every "to confirm" here becomes a written question to the supplier from the vendor question bank before you continue.
Step 3: consultation #
Who was asked (the staff who will use it; a route for pupil and parent views where the tool is pupil-facing), what they said, and what changed as a result. If nobody was consulted, say why.
Step 4: necessity and proportionality #
The purpose in one sentence. The lawful basis (public task, usually, for a state school's core work). What the tool does not need: name what you are withholding (names, whole cohorts, indefinite retention). Whether the same benefit could come with less, or with no tool at all.
Step 5: risks #
For each risk, likelihood and severity. Always walk the AI list: inputs used for training; hallucinated statements entering records; biased outputs affecting some pupils more than others; data leaving the UK; a safeguarding disclosure inside pupil work reaching the tool before the DSL; the tool changing under you (model, features, terms); a decision with a legal or similarly significant effect on a person made without meaningful human involvement.
Step 6: measures #
For each risk: what you will do, who does it, and the risk that remains. Typical measures: pseudonymised inputs, a person reviewing every output before it reaches a pupil, contract clauses (no training, UK or EU processing, retention, deletion on exit), register conditions narrowing the use, and review triggers.
Step 7: sign-off and outcomes #
| The DPO's advice | [recorded in full; if not followed, the reasons] |
| Decision and decision-maker | [approved / approved with conditions / declined] · [name and role] · [date] |
| Residual risk | [low / medium / high] |
| Carried into the register entry and the privacy notice | [what] |
| Review date and triggers | [date]; a model or feature change, new terms, an incident or complaint, any new use |
If a high risk remains after the measures, the school must consult the ICO before the processing starts (UK GDPR Article 36); the ICO says it responds within eight weeks, or up to fourteen in complex cases. In practice the finding is usually "not like this": narrow the use, reconfigure, or choose another tool.
The facts behind this template
Every claim above is numbered to one of these records. Each gives the source’s own words where it can, the paragraph or section, and the date it was last read.
- 01
A DPIA is required before processing that is likely to result in a high risk to people's rights and freedoms, in particular where new technologies are used. It is not required before every tool that processes pupil data.
“in particular using new technologies”
UK GDPR, Article 35: Data protection impact assessment, Article 35(1). Read 28 September 2026.
- 02
Where a DPIA shows that a high risk remains after the planned measures, the controller must consult the ICO before the processing starts. The trigger is a remaining high risk, not "a serious risk that cannot be reduced".
UK GDPR, Article 36: Prior consultation, Article 36(1). Read 28 September 2026.
- 03
The ICO's list of processing likely to be high risk starts with innovative technology, including AI, which needs a DPIA when combined with any other high-risk criterion from the European guidelines, such as vulnerable data subjects, which include children. The ICO's separate list entry on children is narrower: marketing, profiling, automated decisions, or offering online services directly to children.
“including AI”
Data protection impact assessments (DPIAs) guidance, When do we need to do a DPIA?; Examples of processing likely to result in high risk. Read 28 September 2026.
- 04
The ICO leaves each organisation to decide who carries out its DPIAs and who signs them off. The DPO's advice should be recorded on the DPIA, with the reasons if it is not followed; the reasons should be documented whenever a DPIA is judged unnecessary; and a DPIA is a living process.
“You should record your DPO's advice on the DPIA. If you don't follow their advice, you should record your reasons”
Data protection impact assessments (DPIAs) guidance, How do we do a DPIA?. Read 28 September 2026.
- 05
If a high risk remains, the ICO must be consulted before the processing goes ahead; the ICO says it will respond within eight weeks of receiving the DPIA, or up to fourteen in complex cases.
“if there is still a high risk, you need to consult the ICO before you can go ahead”
Data protection impact assessments (DPIAs) guidance, Do we need to consult the ICO?. Read 28 September 2026.
- 06
The DPO's tasks include advising on and monitoring the DPIA, and the DPO's other tasks must not result in a conflict of interests. A DPO who drafts, advises on and approves the same DPIA is marking their own homework.
UK GDPR, Article 39: Tasks of the data protection officer, Article 39(1)(c); Article 38(6). Read 28 September 2026.
- 07
A section on procuring educational technology was added on 9 July 2026. It says a DPIA must be completed when processing is likely to result in a high risk, as early as possible, with the DPO's advice, and kept updated as and when the processing changes; suppliers must be able to explain how their tool works, including how AI outputs are moderated and whether data is used to train the model; the DPO and DSL must be consulted before purchase; and tools must be monitored after it.
“Suppliers must be able to explain how their tool works, including: how the AI (artificial intelligence) outputs are moderated; if the data is used to train the AI (artificial intelligence) model”
Data protection in schools: Procuring educational technology (EdTech), the section. Dated 9 July 2026. Read 28 September 2026.
- 08
Since 5 February 2026, UK GDPR Articles 22A to 22D (inserted by section 80 of the Data (Use and Access) Act 2025) govern automated decision-making. A significant decision is one with a legal or similarly significant effect on the person; a decision is solely automated when there is no meaningful human involvement in taking it. People must be told, be able to make representations, obtain human intervention and contest the decision; stricter limits apply to special category data.
“no meaningful human involvement in the taking of the decision”
UK GDPR, Articles 22A to 22D: automated decision-making, Articles 22A to 22D; commencement by SI 2026/82, regulation 2(j). Dated 5 February 2026. Read 28 September 2026.
Cite this template
Wes (2026). DPIA template for AI tools. School AI Governance. https://schoolaigovernance.co.uk/templates/dpia-template
Free to use, adapt and share in education under CC BY-NC-SA 4.0. Each section heading carries its own link, so a reference can point at one part.