This article explores the use of DPIAs in schools, when they
must be used and tips on undertaking a meaningful assessment of
data protection risks.
Data Protection Impact Assessments
("DPIAs") are a crucial part of any
school's data protection toolbox.
DPIAs help to identify risks to personal data at the outset of a
project so that the protection of personal data is a key
consideration throughout delivery. DPIAs also act as a good
opportunity to pause and consider the measures currently in place
within a school for data protection compliance and to develop these
processes on an ongoing basis.
Obligation to undertake a DPIA
A DPIA must be undertaken where there
is likely to be a high risk to the rights and freedoms
of a data subject resulting from a processing
activity. A processing activity is a broad term to describe
something the school is planning to do involving personal data.
