Legal
Data protection impact assessment
Whether your institution needs one, what we provide for it, and the risks we have not eliminated.
Whether you need one
Under Art. 35 GDPR a data protection impact assessment is required where processing is likely to result in a high risk to people's rights. Processing children's data at scale is on most supervisory authorities' lists of operations that trigger it, and several German Landesbeauftragte name school software specifically.
The assessment is the institution's, not ours. You are the controller; we are the processor. What we can do is give you everything the assessment needs so that writing one is a morning rather than a project.
What we provide
- A description of the processing: what data, for what purpose, on what basis, for how long, and who can reach it. Most of it is on the privacy page already.
- The technical and organisational measures, in enough detail to be assessed rather than taken on trust.
- The sub-processor list with purposes and regions.
- Our own risk analysis, including the risks we have not eliminated.
The risks worth naming
A DPIA that lists no residual risk has not been written honestly. Ours:
- A revoked Cue can still be admitted to a lesson run on the kit network by an iPad whose cache is stale. The teacher's iPad learns of a revocation when it next reconnects. This is inherent to working without a network, it is bounded by how long a device goes without syncing, and the host warns when its cache is more than a week old.
- Teacher notes are free text. A teacher can type anything into one, including a special category of data, and nothing prevents it. They are visible only to that teacher and expire on the institution's schedule, but the field is as safe as the person using it.
- One sub-processor is outside the EU. The AI provider receives scenario text, class-list column headings with at most five sample rows, and aggregate usage figures. No lesson record reaches it — enforced three ways. The sample rows of a class list can contain names; they are shown to a person for review, and an institution can switch the features off entirely.
- Printed credentials can be lost. A slip for a staff account without an email address carries a username and a one-time password, and it is paper. The password must be changed at first sign-in, which bounds it, and paper is still paper.
Asking for it
Write to hello@spontar.com and say which authority's template you are working to, if any. We will fill in what is ours to fill in and leave the rest clearly marked, because a document that answers your questions for you is a document your DPO cannot rely on.