DPIA - pre-completed for your school

How to use this template

Under UK GDPR your school is the data controller for pupil data processed in Chapter Schools, and a DPIA is your school's document - it must be completed and signed off on your side. To make that a review job rather than a research project, Chapter Technologies Ltd (your data processor) has pre-completed every section that describes our processing, security measures and risks. Sections marked ✎ School to complete are yours: your context, your consultation, your DPO's advice and sign-off. Verify our pre-filled statements against the linked source documents, amend anything to fit your school's circumstances, and keep the completed document with your records of processing.

• Companion documents: Data Processing Agreement (chapterschools.com/dpa) · Security overview & sub-processor register (chapterschools.com/security) · Chapter's own DPIA (chapterschools.com/dpia) · Safeguarding statement (chapterschools.com/safeguarding-statement)
• Questions while completing it: luke@chapterapp.co.uk - we answer DPO queries directly.

Document control

Step 1: Identify the need for a DPIA

A DPIA is required. The processing involves children's personal data at scale, delivered through new technology including generative AI features, and includes data about potentially vulnerable data subjects - each an ICO trigger criterion for a mandatory DPIA.

The project: adoption of Chapter Schools, a careers education management platform, to deliver and evidence the school's careers programme(the statutory duty at Education Act 1997 s.42A; the Gatsby Benchmarks), including MIS roster sync, careers activity tracking, employer encounter management, an optional linked student app, and parent engagement digests.

Step 2: Describe the processing

2.1 Nature

• Pupil roster imported from the school's MIS via Wonde (school-approved, read-only sync) or CSV upload; synchronised daily. Where the school connects through Wonde and its MIS holds them, the sync also brings yes/no support indicators - free school meals or Pupil Premium eligibility, SEND and looked-after status - and an attendance percentage with a persistent-absence flag, used to prioritise careers guidance and destination follow-up for the pupils who most need it (see 2.2 and risk R14).
• Recording of careers activities, employer encounters, guidance sessions and Gatsby Benchmark evidence by school staff.
• The Chapter student game (web, iOS and Android), for pupils the school brings on: careers exploration, quests, CV and personal-statement builders, work-experience diaries, interview practice and AI guides that pupils chat with and can share documents with. Engagement summaries flow back to the school dashboard. Social features - chat, multiplayer and friend requests - connect only pupils verified as belonging to the same school, show pupils each other's names, and are switched off entirely for primary-age pupils.
• Optional: where a pupil has linked a Chapter student account, their apprenticeship application stages, pathway intentions and post-rejection reflections flow from the student app back to the school's apprenticeships tracker. This is covered by the school's public task - the careers guidance duty at Education Act 1997 s.42A, and the Gatsby Benchmark 3 requirement to keep a record for each pupil. Parent visibility is student-initiated for pupils aged 13 and over (ICO guidance on competent children), and rests on two decisions the pupil makes: sharing that individual application, and agreeing that the school may process their apprenticeships record at all. Both are required - without both, the parent sees nothing.
• Optional: parents/carers receive email digests of their own child's careers activity.
• Optional: work-experience placements, with parent/carer consent captured in the Chapter Family app or by emailed link (name, email, phone, the signature, and the network address and time the consent was given, kept as evidence).
• Optional: pupils' leaver destinations and stated aspirations recorded by staff, or answered by the pupil in the student app, to meet the school's destination-tracking duty.
• AI-assisted tools for staff. Lesson plans, worksheets and slides use contextual data only (year group, topic). Guidance-session summaries, student insight profiles, UCAS personal-statement and reference feedback send the relevant free text to the AI provider (Anthropic) with the pupil's names replaced by an opaque placeholder before it leaves Chapter, and restored in the response. The AI guides in the student game receive the pupil's stage (year-group band), stated interests and the conversation - not their name or age. Documents a pupil or member of staff chooses to share with an AI tool, such as a CV, are sent as written and may contain identifying details. The provider's commercial terms exclude use of inputs for model training and do not retain them. Dictated session notes are transcribed by OpenAI and the audio is not stored; photographed handwritten notes and filled-in pupil worksheets are read once and the image is not stored.
• Everything a pupil writes in the student app - chat, diary entries, messages - passes through automated moderation (OpenAI moderation model, configured to block if unavailable). A concern about an identifiable pupil is routed to the school's designated safeguarding lead, who decides what happens next.
• The Chapter student game and the Chapter Family parent app: When the school brings its pupils and their families onto Chapter - through the MIS sync, a school invite or join code, or a pupil linking their own account to the school - the school is the controller for their data in the Chapter student game, including its social features, and in the Chapter Family app, and Chapter processes it for the school under the Data Processing Agreement. When a pupil leaves the school, or if the school stops using Chapter, the pupil's game account carries on with them and Chapter becomes the controller for it from then on, under the game's privacy policy; a pupil under 13 carries on only with a parent or carer's agreement, as that policy sets out. The School keeps its own records of the pupil's time at the school, and any destinations follow-up it asks Chapter to run stays the school's. Chapter is also the controller for what a pupil or family does with Chapter independently of the school, such as a pupil aged 13 or over using their own account outside the school's use of it, or a Chapter Premium subscription a family buys for themselves. Pupils and parents are told this in the game's privacy policy (chaptergame.com/privacy).

2.2 Data categories

• Pupils: name and legal name, date of birth, UPN/ULN, admission number, school email, year and form group, named adviser; careers activity, encounter and Gatsby evidence records; guidance-session notes and action plans; work-experience placement, consent and diary records; UCAS choices, personal-statement drafts and reference text where the school uses those tools; apprenticeship applications and stated pathway intentions; leaver destinations; in the student game, avatar and game progress, conversations with AI guides and (within the school) with other pupils, and documents or photos the pupil uploads. Location is used on the pupil's own device only if they switch it on, to show nearby opportunities, and is not stored by Chapter.
• Support indicators (Wonde only): yes/no flags for free school meals or Pupil Premium eligibility, SEND and looked-after status, and attendance percentage with a persistent-absence flag. No details of a pupil's needs, and no medical, behaviour or safeguarding records, are imported.
• Staff: name, email, role, sign-in and audit records.
• Parents/carers: name, email, phone, link to child (from MIS parental-responsibility data), consent evidence, digest delivery records.
• Employers, providers and volunteers: business contact details, event and encounter feedback.

Special category data: a SEND flag can indicate information about a pupil's health, so the school should treat it as special category data (UK GDPR Article 9) and record the condition it relies on - for many schools Article 9(2)(g) substantial public interest with a Data Protection Act 2018 Schedule 1 condition, to be confirmed by your DPO. Chapter does not otherwise intentionally process special category data. Free-text fields could incidentally contain sensitive information, so staff are instructed not to record it there (see risk R8).

2.3 Scope and context

• Scope: every pupil on roll in the year groups the school enrols (from primary or prep years through to sixth form, depending on the school), their parents and carers, and the staff who run the careers programme, for the whole subscription plus the 90-day deletion window. Processing is continuous (nightly sync) and UK-wide in coverage.
• Context: the data subjects are children, so the ICO Age Appropriate Design Code applies: high-privacy defaults, no advertising, no profiling for commercial purposes, geolocation off, and notices written for the youngest pupil. Access is school-mediated, so pupils and parents can reasonably expect careers-education processing by their school; the student app is a new technology (a game with AI guides), which is why this assessment is required.

2.4 Storage, location and retention

• Primary data storage: Supabase (PostgreSQL), hosted in the United Kingdom (London, AWS eu-west-2). Encrypted in transit and at rest.
• Limited flows to sub-processors including AI providers (US) under appropriate transfer safeguards - see the sub-processor register at chapterschools.com/security.
• Retention: pupil data retained for the duration of the subscription and deleted within 90 days of termination (or immediately on request), with export available first. An automated retention process flags pupil data that has passed its retention period during the subscription. Full schedule: chapterschools.com/dpia.

✎ School to complete: note where this processing appears in your record of processing activities (ROPA), and confirm your privacy notice covers careers education processing and the categories above.

Step 3: Consultation

✎ School to complete: record who you consulted (DPO, careers lead, DSL, IT lead; pupil/parent voice where proportionate) and what they said. Chapter will answer any technical or data protection query from your DPO during this step: luke@chapterapp.co.uk.

Step 4: Necessity and proportionality

• Lawful basis: Article 6(1)(e) public task - delivery of statutory careers education under the Education Act 1997 and the DfE's careers statutory guidance. The school's contract and DPA with Chapter govern the processor relationship (Article 28).
• Data minimisation: only roster fields needed for careers tracking are synced; teacher access is scoped to assigned groups; parents see only their own child's summary.
• Accuracy: daily MIS synchronisation keeps records aligned to the school's authoritative source; manual correction available.
• Data subject rights: export and deletion are supported at any time; subject access, rectification and erasure requests are actioned with the school as controller.
• Privacy information: the school updates its pupil and parent privacy notices to name Chapter as a processor for careers education; Chapter's own notices for the student and parent apps are written for the youngest user.
• Function creep: school data is used only to provide the platform to the school - never for advertising, never to train AI models, never sold; the Data Processing Agreement fixes this and any new purpose needs the school's written instruction.
• International transfers: data rests in the UK; the limited flows to US AI and infrastructure providers rely on the UK Extension to the EU-US Data Privacy Framework or the IDTA/UK Addendum, as recorded per vendor on the sub-processor register.
• Processor compliance: the Data Processing Agreement contains every Article 28(3) term; sub-processor changes come with 30 days' notice and a right to object; audits are allowed on reasonable notice.
• Alternatives considered: spreadsheet-based tracking (weaker security, no access control, no automated retention) or no dedicated system (statutory duty harder to evidence).

Step 5: Identify and assess risks

Step 6: Measures to reduce risk

Step 7: Sign-off and outcomes