Data protection impact assessment (DPIA): draft

Tool: Gemini in Google Meet (Take notes for me) Supplier: Google
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-10-26). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	meeting notes / transcription
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - staff meetings; Workspace with Gemini features need users aged 18 or over [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	processor (governed by the Workspace agreement and Cloud Data Processing Addendum)
Where data is stored	Google infrastructure, region not stated; international transfers under the SCCs in Google's Cloud Data Processing Addendum
Trains AI on inputs	no - content not human reviewed or used for generative AI model training outside your domain without permission (Workspace Privacy Hub)
How long inputs are kept	notes saved as a Google Doc in the organiser's Drive and follow the Meet retention policy the organisation sets (Vault)
Data processing agreement	https://cloud.google.com/terms/data-processing-addendum Signs individual DPAs: yes - Cloud Data Processing Addendum is part of the Workspace agreement
Supplier DPO / UK representative	Not stated by the supplier. [School to complete: contact details]
Minimum age	18+ (Workspace with Gemini, school accounts)
Other safety notes	needs an eligible paid edition (e.g. Google AI Pro for Education); admins can require all participants to consent before notes start; tell everyone notes are being taken
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Green, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
Data may be stored outside the UK/EU (Other / unclear)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ (Workspace with Gemini, school accounts)	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://support.google.com/meet/answer/14754931?hl=en
https://support.google.com/meet/answer/13952129?co=DASHER._Family%3DEducation&hl=en
https://support.google.com/a/answer/15706919?hl=en
https://cloud.google.com/terms/data-processing-addendum