DPIA
Data Protection Impact Assessment template
School-ready risk, safeguard, and data-flow review materials for FairCall pilot evaluation.
Download compliance artifacts
Core template and data-flow files for school data-protection leads.
Download Word (.docx)
Editable DPIA template for school adaptation.
Download PDF
Review-ready PDF version of the DPIA template.
Download Plain Text
Lightweight text copy for procurement or legal markup.
Download Data Flow Map
Narrative flow map covering core pilot data movement.
Download Data Flow Register
Structured CSV register of controller and processor flows.
DPIA purpose
This template is designed for UK schools evaluating FairCall pilot use. It can be copied and adapted by each school's data-protection lead, with an attached data-flow artifact set.
Product description
- What: Cold-call equity tracker for teachers.
- Who: Individual teachers in UK schools.
- Why: Improve classroom participation equity and reflection.
Data collected
- Teacher: email and password hash.
- Students: names, optional student ID, optional photo URL.
- Lesson events: timestamps and optional outcomes (correct/partial/incorrect).
1. Risk assessment
| Risk | Potential impact | Mitigation |
|---|---|---|
| Unauthorized access | Exposure of teacher and student data | Encryption, authentication, tenant isolation |
| Data loss | Loss of reflection records | Backups, offline queue, sync recovery |
| Surveillance perception | Reduced trust and adoption | Teacher-only framing, reflection-first guidance |
| Student anxiety | Classroom wellbeing concerns | Positioning guidance, optional logging behavior |
2. Safeguards
- No free-text notes on students in MVP design.
- No student-facing app features.
- Tool is for teacher reflection, not grading.
- No demographic data collection in MVP.
3. Data retention and deletion
- Default retention target: current academic year + 1.
- Teachers can delete data and accounts at any time.
- Account closure deletion behavior follows product retention controls.
4. Subprocessor list
- Vercel (frontend hosting, USA/EU)
- Railway (database and backend hosting, UK/EU region)
- Cloudflare R2 (future option, EU region target)
5. Data flow map (pilot-ready)
Attach both artifacts to your DPIA record: the narrative map and the structured flow register. These map teacher authentication, roster setup, live lesson events, analytics, in-app support intake, and export and sharing paths.
- Narrative data flow map: /templates/data-flow-map.txt
- Structured flow register: /templates/data-flow-map-register.csv
- Controller and processor roles and safeguards are documented per flow.
6. School customization checklist
School sign-off checklist
- Confirm controller identity and legal basis.
- Set school-specific retention schedule and deletion policy.
- Add school-specific technical and organizational controls.
- Record residual risk decision and approval sign-off.
Related compliance documents
Continue school review with privacy, terms, and DPA references.
Need help with school sign-off?
Use the right support path for policy gaps, risk-review blockers, or account-level export and deletion controls.