Data protection impact assessment (DPIA): draft

Tool: Brisk Teaching Supplier: Brisk Labs Corp.
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-10-23). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	teacher tools
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: Not stated by the supplier. [School to complete: staff only, or pupils too?] [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	processor for school accounts; controller for its own purposes incl. anonymised training datasets (DPA s.3.1)
Where data is stored	wherever Brisk or sub-processors have facilities; transfers under SCCs + UK Addendum (DPA s.7.1, s.13, Sched. 3)
Trains AI on inputs	depends - DPA lets Brisk create anonymised datasets from school data to train or evaluate its own products
How long inputs are kept	copy available for 30 days after the agreement ends, then deleted; accounts closed after 18 months inactivity
Data processing agreement	https://www.briskteaching.com/privacy/brisk-data-processing-addendum Signs individual DPAs: yes - DPA forms part of the agreement
Supplier DPO / UK representative	Not stated by the supplier. [School to complete: contact details]
Minimum age	Not stated by the supplier. [School to complete: minimum age]
Other safety notes	DPA effective 31 Aug 2026
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Amber.

Risk	Suggested measure	Likelihood / severity	Residual risk
Unclear whether inputs are used for AI training	Ask the supplier in writing; check plan settings.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: not stated	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://www.briskteaching.com/european-and-uk-privacy-notice
https://www.briskteaching.com/privacy/brisk-data-processing-addendum
https://www.briskteaching.com/privacy/brisk-data-processing-addendum