Data protection impact assessment (DPIA): draft

Tool: Orkas Supplier: Orkas (operating entity not named; based in mainland China, Guangdong ICP filing 粤ICP备2025473014号)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-04). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	presentations / multi-agent AI desktop app (slides, documents, research, images, video)
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - a desktop app for adults and small businesses; no pupil accounts or classroom features [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	not stated - consumer terms only; no school or organisation data-processing terms
Where data is stored	People's Republic of China - account and sync data stored on infrastructure in mainland China; tasks, files and outputs stay on the device by default; Orkas-managed model, search, image, video and speech requests go through Orkas servers to unnamed upstream providers, which may be outside China; no protections for transfers from Britain stated
Trains AI on inputs	no - says it does not use your content to train AI models
How long inputs are kept	local data stays on the device under your control; account records deleted or anonymised within 30 days of closing the account; cloud sync copies deleted 7 days after a paid plan ends; service activity records typically up to 90 days; managed-feature request logs kept for a limited period (not specified)
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representative	not stated (support@orkas.ai)
Minimum age	13+ - under the age of majority needs a parent or guardian's permission
Other safety notes	general-purpose AI agent app for macOS and Windows aimed at businesses, not built for schools; agents run on your computer with the access you grant and can act through connected email, calendar, files and other tools; Chinese law governs the terms and disputes go to courts in mainland China; open source (MIT licence); built-in models use credits (500 free, paid plans from $5.99 a month) or you can connect your own model provider; output must be reviewed
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
Data may be stored outside the UK/EU (Other / unclear)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 13+ - under the age of majority needs a parent or guardian's permission	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
Supplier not confirmed as a processor acting on school instructions	Clarify roles in the contract.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://orkas.ai/views/legal/privacy.html
https://orkas.ai/views/legal/terms.html
https://orkas.ai/security/
https://orkas.ai/pricing/
https://github.com/Orkas-AI/Orkas