What your DPO will ask, in their order
Your designated safeguarding lead and your data protection officer will both read this before you sign. It is written to be read without us in the room.
The Department for Education tells schools what to obtain from a supplier before purchase. This is that list, answered, in the order they ask it.
Nothing here is behind a form.
Controller or processor
The school is the controller. Butter is the processor. Stated per processing activity, dated, in writing.
Where the data sits
The United Kingdom. Storage region, backup region, and who can see it from where, including support.
Sub-processors
Named, with what each does and where it is, and a commitment to tell you before that changes.
Retention and deletion
Actual periods, not “as long as necessary”. Deletion confirmed on exit, in a format you can keep.
Whether any child’s data trains a model
It does not, and that is contractual rather than a statement of current practice.
The Children’s Code
Our position, written out rather than asserted.
The four fields we read
Name, year and form, school email, and for staff which forms they tutor. Not attendance, not behaviour, not special educational needs, not free school meals, not medical, not addresses, and no household information of any kind. The field list is contractual and it cannot widen without a variation you sign.
A DPIA you don’t start from nothing
Pre-filled, with the facts you need to finish it.
Breach notification
Stated in the processing agreement.