← Back to Bromcom AI

This is a starting point, not legal advice. It is pre-filled from what Bromcom Computers plc publishes and what we found on 2026-10-23. The highlighted gaps are for your school to complete. Your data protection officer (DPO) should review the finished DPIA.

Data protection impact assessment (DPIA): draft

Tool: Bromcom AI   Supplier: Bromcom Computers plc
School: [School to complete: school name]   Prepared by: [School to complete: name and role]   Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-10-23). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of toolMIS AI assistant
Purpose in our school[School to complete: what you will use it for, which year groups or staff, and why]
Who will use itSupplier says pupil-facing: no - staff-facing
[School to complete: number and roles of users]
Personal data involved[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controllerprocessor for MIS data (school/MAT/LA is controller)
Where data is storedQuick Reports: Azure OpenAI UK; general bots: OpenAI API (US); help bots: Gemini (EU), Mistral/ElevenLabs (EU/UK)
Trains AI on inputsno - contractual training opt-outs with all providers
How long inputs are keptAzure: no retention by OpenAI; OpenAI API up to 30 days; Gemini up to 24 hours; voice metadata up to 730 days
Data processing agreementNot stated by the supplier. [School to complete: DPA reference or date signed]
Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representativeNot stated by the supplier. [School to complete: contact details]
Minimum ageNot stated by the supplier. [School to complete: minimum age]
Other safety notesanything staff type into the general chatbot goes to OpenAI (US); Bromcom humans review logs; AI can be switched off by role or system-wide
Lawful basis[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Red.

RiskSuggested measureLikelihood / severityResidual risk
Data may be stored outside the UK/EU (Mixed)Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).[School to complete: low / medium / high][School to complete: accepted?]
No data processing agreement publishedRequest a DPA before use, or limit use to non-personal data.[School to complete: low / medium / high][School to complete: accepted?]
Minimum age: not statedCheck this against the age of any pupils who will use it.[School to complete: low / medium / high][School to complete: accepted?]
AI output may be inaccurate or biasedStaff review all output before it is used; do not rely on it for decisions about individuals.[School to complete: low / medium / high][School to complete: accepted?]
[School to complete: any other risks][School to complete: measure]

4. Sign-off

DPO advice[School to complete: DPO comments and date]
Decision[School to complete: approved / approved with conditions / not approved]
Approved by[School to complete: name, role, date]
Review date[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

  • https://docs.bromcom.com/knowledge-base/bromcom-ai-data-processing/
  • https://bromcom.com/privacy
  • https://docs.bromcom.com/product-portfolio/bromcom-ai/