Data protection impact assessment (DPIA): draft

Tool: The National College (Teacher & Leader AI) Supplier: National Education Group Ltd (England and Wales, company 10738856, Sheffield); People Development (formerly BlueSky) is run by group company Atkey Solutions Limited
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-05). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	leadership / school CPD and compliance platform with Teacher & Leader AI chat and prompts; People Development appraisal, quality assurance and lesson observations
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - for school and trust staff, leaders and governors; no pupil accounts or classroom use described [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	processor for member schools and trusts (membership terms clause 10; the school is controller); controller for its own usage monitoring, analytics and published reviews
Where data is stored	UK - says AI models and school data are housed in the UK, not offshore, and that Teacher & Leader AI does not send or store data with third-party AI providers; membership terms bar transfers outside the UK without the school's written consent except as UK GDPR allows; privacy notice says IT providers may involve transfers outside the UK with safeguards; hosting provider and the underlying AI model not named
Trains AI on inputs	no - says data entered into Teacher & Leader AI is not used to train AI models
How long inputs are kept	not stated - school data is deleted or returned at the end of the membership; records kept for legal reasons normally at least six years
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: not stated - processor commitments are written into the membership terms (clause 10); a separate signed DPA is not mentioned
Supplier DPO / UK representative	dpo@nationaleducationgroup.com (UK operator)
Minimum age	not stated - staff platform; no pupil use described
Other safety notes	UK CPD and compliance platform; Teacher & Leader AI is included with every membership and the supplier says it runs inside its own platform, but it does not name the AI model behind it; claims Cyber Essentials Plus, ISO 9001 and ISO 42001; People Development holds appraisal, objectives, CPD and lesson observation records, and appraisers and appraisees can see each other's entries; AI-powered site search is described as learning with every use; terms say AI results can be inaccurate and must be checked against other sources; usage data is analysed for the supplier's own purposes and shared in anonymised form
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: not stated - staff platform; no pupil use described	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://nationalcollege.com/privacy
https://nationalcollege.com/terms
https://support.nationalcollege.com/how-is-teacher-leader-ai-safe-and-secure
https://info.nationalcollege.com/teacher-leader-ai
https://info.nationalcollege.com/whole-school-support-to-implement-ai
https://info.nationalcollege.com/people-development
https://info.nationalcollege.com/new-features-and-functionality