School details
School: [School name and address]
Data protection officer: [Name and contact]
Completed by and date: [Name, role, date]
Step 1: Why a DPIA is needed
The school plans to use Kudolings, an online classroom service, to recognise pupils’ positive behaviour, take the register and share each child’s progress with their parents. It processes personal data about children using a new technology, so the school is completing a DPIA as good practice.
Step 2: Describe the processing
Nature
Teachers add their class list to Kudolings. Each pupil gets an animated character (a Kudoling) on the class’s interactive board. Teachers record positive behaviour, points taken away (with a reason), attendance and short comments. Parents who are invited see only their own child’s progress. A school administrator can view a summary of classes whose teachers join the school account. Pupils do not have accounts and do not use devices.
Scope
- Pupils: first name and (optionally) surname, pupil number and birthday (day and month); class; attendance; rewards and points; badges; teacher comments and report comments; house.
- Staff: name, email address, optional phone number, login records.
- Parents: name, email address, linked child, login records.
- No special category data is needed. Number of pupils: [e.g. 420]. Classes and year groups: [e.g. Reception to Year 6].
- Retention: while the school uses the service; removed pupils anonymised after one year; backups deleted after 30 days; deletion or return at the end of the agreement.
Context
Pupils are children aged 4 to 11 and may not understand the processing, so the school informs parents (for example with the ready-made letter to parents and the school’s privacy notice). Parents would reasonably expect behaviour and attendance to be recorded by the school. Kudolings is a processor acting on the school’s instructions under the School Data Processing Agreement.
Purposes
Encouraging positive behaviour, classroom management, keeping parents informed about their own child, and giving school leaders an overview.
Lawful basis chosen by the school: [e.g. UK GDPR Article 6(1)(e), public task, for a maintained school or academy]
Step 3: Consultation
[Who the school consulted, for example the headteacher, staff, governors and parents, and what they said.] Kudolings will answer the school’s questions and provide further information on request.
Step 4: Necessity and proportionality
- Only the data needed for the purposes is collected; surname, pupil number and birthday are optional.
- Data stays in the EU, is not used for advertising or sold, and no analytics or advertising cookies are used.
- Parents can see their own child’s records; staff and parents can download their data or delete their account on their profile page.
- The processor’s obligations and sub-processors are set out in the School Data Processing Agreement.
Step 5 and 6: Risks and measures
| Risk | Measures in place | Risk before | Residual risk |
|---|---|---|---|
| Pupil records seen by someone who shouldn’t see them (for example another parent or another school). | Every request is checked on the server: teachers reach only their classes, parents only their own linked child. Parents join with single-use codes or are approved by the teacher. View-only links show no names. Visiting teachers see the Kudolings’ names, not pupils’ names, unless the teacher chooses to show first names; the teacher can turn visits off. | Low | Low |
| A teacher’s account is taken over (weak or reused password, shared computer). | Passwords hashed with Argon2id; login attempts limited and paused after 5 failures; sessions end after 60 minutes idle and 12 hours at most; changing the password logs out other devices; break lock on the board. | Medium | Low |
| Sensitive information (for example health or safeguarding details) typed into comments. | Comment fields are short and labelled as visible to parents; the school’s instructions to staff (below) say not to record sensitive information in Kudolings. | Medium | Low |
| Pupils feel judged or compared with each other. | No leaderboard; class goals are shared; points taken away are optional, need a reason and can be undone. | Low | Low |
| Data kept longer than needed. | Removed pupils are anonymised after one year; deleting an account anonymises its pupils straight away; backups are deleted after 30 days; schools can ask for deletion or return at the end of the agreement. | Medium | Low |
| Data transferred outside the UK. | Data is stored in the Netherlands (EU, covered by UK adequacy regulations). Cloudflare (USA) handles connections under the UK Extension to the Data Privacy Framework and/or the International Data Transfer Addendum. | Low | Low |
| Service unavailable or data lost. | A database backup is taken before every update; updates are tested first on a separate test site. | Medium | Medium |
The school’s own measures: [e.g. staff told not to record health, safeguarding or other sensitive details in comments; accounts closed when staff leave; staff use school email addresses.]
Step 7: Sign-off
| Measures approved by | [Name, date] |
|---|---|
| Residual risks approved by | [Name, date] |
| DPO advice | [Summary of advice] |
| Review date | [e.g. in 12 months] |
Provider: [Company name] Ltd · ICO registration [ICO registration number] · Contact: kudolings.com/#contact