What is DPIA (Data Protection Impact Assessment)?

A DPIA helps you think through how you will use personal data before you start. It describes what data you will collect and why, whether it is necessary and proportionate, what could go wrong, and what you will do to reduce the risks. The Information Commissioner’s Office (ICO) publishes guidance, examples and a template.

A DPIA is legally required where processing is likely to result in a high risk, particularly when using new technologies. The ICO says that if you process data about vulnerable people, including children, you should consider a DPIA, and one will be needed if other high-risk criteria also apply. Many schools and providers complete a DPIA as good practice when introducing a new system that holds pupil data, such as an MIS, a pupil database or a new online app. If a DPIA finds a high risk you cannot reduce, you must consult the ICO before starting.

A DPIA is not a one-off form. Review it when the way you use data changes.

Why it matters for your setting

• Choosing a new system for pupil records is a natural time to complete a DPIA.
• Commissioning schools and local authorities may ask to see your DPIA or data protection arrangements.
• Working through the risks often leads to simple, practical improvements, such as tighter access or shorter retention.