Data protection impact assessment (DPIA): draft
Tool: Turnitin (Feedback Studio / AI writing detection) Supplier: Turnitin
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]
Draft generated by AI Prefect from the supplier’s published documents (checked 2026-10-23). A starting point only; not legal advice. Verify every fact before relying on it.
1. What the tool will be used for
| Type of tool | AI detector / plagiarism |
|---|---|
| Purpose in our school | [School to complete: what you will use it for, which year groups or staff, and why] |
| Who will use it | Supplier says pupil-facing: yes - students submit work [School to complete: number and roles of users] |
| Personal data involved | [School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible] |
2. How the supplier handles data
| Processor or controller | processor (institution is controller) |
|---|---|
| Where data is stored | global environment (US/Canada); new UK Feedback Studio customers can choose EU (Frankfurt) storage; existing accounts cannot switch |
| Trains AI on inputs | no generative model trained; YES - if AI detection is enabled, anonymised current student writing may be used to train the AI-detection classifier |
| How long inputs are kept | submissions may be kept indefinitely in Turnitin's repository unless the institution requests deletion |
| Data processing agreement | https://www.turnitin.com/agreement.asp Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier] |
| Supplier DPO / UK representative | Not stated by the supplier. [School to complete: contact details] |
| Minimum age | Not stated by the supplier. [School to complete: minimum age] |
| Other safety notes | AI-writing scores are a prediction, not proof; feedback summaries use Claude Haiku (Anthropic does not retain/train); video captions via Amazon Transcribe |
| Lawful basis | [School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data] |
3. Risks and how we will reduce them
AI Prefect rating: staff Amber, pupils Amber.
| Risk | Suggested measure | Likelihood / severity | Residual risk |
|---|---|---|---|
| Data may be stored outside the UK/EU (Mixed) | Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy). | [School to complete: low / medium / high] | [School to complete: accepted?] |
| Minimum age: not stated | Check this against the age of any pupils who will use it. | [School to complete: low / medium / high] | [School to complete: accepted?] |
| AI output may be inaccurate or biased | Staff review all output before it is used; do not rely on it for decisions about individuals. | [School to complete: low / medium / high] | [School to complete: accepted?] |
| [School to complete: any other risks] | [School to complete: measure] |
4. Sign-off
| DPO advice | [School to complete: DPO comments and date] |
|---|---|
| Decision | [School to complete: approved / approved with conditions / not approved] |
| Approved by | [School to complete: name, role, date] |
| Review date | [School to complete: usually within 12 months, or when the supplier changes its terms] |
Sources
- https://www.turnitin.co.uk/trust-center
- https://helpcenter.turnitin.com/hc/en-us/articles/49295931087373-Turnitin-Trust-Center
- https://guides.turnitin.com/hc/en-us/articles/27377195682317-Turnitin-Services-Privacy-Policy
- https://www.turnitin.co.uk/blog/turnitin-feedback-studio-regional-data-storage-now-available-in-the-eu-and-apac