Data protection impact assessment (DPIA): draft

Tool: Graded Pro (Grade Direct) Supplier: EdSystems Ltd (UK, company 16551984), trading as Grade Direct
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-01). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	AI marking / feedback
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: yes - students can submit work through teacher or school set-up accounts (portal, app, Google Classroom) [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	processor for pupil data uploaded on behalf of a school (school is controller, under a DPA); controller for account data
Where data is stored	DigitalOcean (US, with EU data centre options) for hosting; OpenAI (US) gets the student first name and the work; transfers under SCCs, UK IDTA/Addendum and DPF where certified (compliance statement)
Trains AI on inputs	no - "We do not use Pupil Data to train AI models"; OpenAI API terms: not retained for training (privacy policy)
How long inputs are kept	kept as long as the school needs; deleted submissions removed from backups within 30 days; on termination deleted from active systems within 30 days and backups within 90 days
Data processing agreement	https://graded.pro/public/DPA.pdf Signs individual DPAs: yes - downloadable Data Privacy Agreement for schools to sign
Supplier DPO / UK representative	DPO contact: richard@grade.direct (DPA)
Minimum age	18+ to create an own account; under-18 students submit only through accounts and assignments set up by their teacher or school
Other safety notes	DPA template is short and generic (sub-processor list on request); recommends pseudonymised student data and no special category data
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Green, pupils Amber.

Risk	Suggested measure	Likelihood / severity	Residual risk
Data may be stored outside the UK/EU (Mixed)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ to create an own account; under-18 students submit only through accounts and assignments set up by their teacher or school	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://graded.pro/pages/privacy
https://graded.pro/pages/gdpr
https://graded.pro/pages/term
https://graded.pro/public/DPA.pdf
https://graded.pro/pages/solutions/compliance