UK GDPR • DPA 2018 • DfE & ICO Children's Code

Pre-Populated School DPIA Template

Designed for School Data Protection Officers (DPOs), IT Leads, and Multi-Academy Trust Compliance Teams. Print or save this document as a PDF and complete the School Sign-Off block at the bottom.

← Back to Schools

Data Protection Impact Assessment (Article 35 UK GDPR)

SkyTyper Classroom & MAT Edition

Pre-Populated Supplier DPIA & Technical Security Assurance Pack for UK Schools

Document Ref: ST-DPIA-2026-V5

Last Reviewed: November 2026

Jurisdiction: United Kingdom (UK GDPR)

1. Data Controller & Data Processor Details

Data Controller (The School or Trust)

School / MAT Name: ____________________________________

DfE URN / Trust ID: ____________________________________

Designated DPO Name: __________________________________

DPO Contact Email: ____________________________________

Data Processor (The Supplier)

Platform: SkyTyper Education (skytyper.co.uk)

Role: Data Processor acting on instructions of the School/Trust

Data Hosting Location: United Kingdom / EEA

Privacy & DPO Contact: skytyper.co.uk/contact.php

2. Description & Purpose of Processing

SkyTyper provides curriculum-aligned touch-typing, mouse control, DfE Letters & Sounds Phonics (Phases 2–5), and custom weekly spelling practice for primary and secondary school pupils. Processing is strictly limited to delivering educational games, recording typing fluency metrics (WPM, accuracy, and missed keys) for teacher assessment, and managing staff access.

✓ Zero Pupil Emails or DOBs

Pupils never enter an email address, date of birth, home address, phone number, or photo.

✓ Zero Roster Enumeration

The pupil login screen (/play) never displays a dropdown list of pupil names. Pupils authenticate via Class Code + Username + PIN.

✓ Strictly Ad-Free & Tracker-Free

Zero third-party advertisements and zero analytics scripts are ever loaded inside pupil or school sessions.

3. Categories of Personal Data Processed (Data Minimisation)

Data Subject	Fields Collected	Fields Explicitly Excluded	Lawful Basis (UK GDPR Art. 6)
School Pupils	• First Name (e.g. `James`) • Last Initial — 1 char (e.g. `B`) • Pseudonymous Username (e.g. `JamesB`) • 4-digit PIN & Class Assignment • Typing WPM, Accuracy %, Missed Keys (A–Z)	× Full Legal Surname × Email Address × Date of Birth / UPN × SEN / FSM / Medical Status × Biometrics / Photos / Audio	Art. 6(1)(e) Public Task (Education delivery by the School) or Art. 6(1)(f) Legitimate Interests (Independent Schools). No Special Category data (Art. 9) is processed.
School & Trust Staff (Teachers, Admins, Bursars)	• Full Name & Work Email Address • Bcrypt-Hashed Password • Role (`school_admin`, `teacher`, `trust_admin`) • Assigned Class(es)	× Personal Home Address × Personal Bank Details	Art. 6(1)(b) Contract & Art. 6(1)(e)/(f) for administering school accounts and BACS invoicing.

4. UK ICO Age Appropriate Design Code (Children's Code) Compliance

1. High Privacy by Default (Standard 7): Pupil profiles are private to their assigned class teacher and school administrator. There are no public leaderboards, public profiles, or inter-pupil chat features.

2. Data Minimisation (Standard 8): Only the minimum data required to identify a pupil to their class teacher (First Name + 1-character Last Initial) is stored.

3. Geolocation & Profiling Disabled (Standards 10 & 12): Geolocation is never requested. Automated behavioral profiling and targeted advertising are permanently disabled.

4. Zero Nudge Techniques (Standard 13): Pupils are never shown upgrade prompts, purchase buttons, or dark patterns encouraging them to share personal data.

5. Technical & Organisational Security Measures (Article 32 UK GDPR)

Encryption in Transit & at Rest: All traffic is enforced over HTTPS (TLS 1.2/1.3) via Cloudflare Edge SSL. Staff passwords are hashed using modern PHP Bcrypt (password_hash).
3-Factor Pupil Authentication without Roster Leakage: Pupils log in at /play by entering their Class Code, Pupil Username, and 4-digit PIN. Invalid inputs return a generic error message and are protected by IP brute-force rate limiting.
Role-Based Access Control (RBAC): Class Teachers (`teacher` role) are strictly scoped to their assigned classes and cannot view or modify pupils in other classes unless granted `school_admin` privileges by the School Lead.
CSRF & SQL Injection Prevention: All state-changing forms enforce cryptographic CSRF tokens (`hash_equals`) and 100% of database queries use parameterised PDO prepared statements.
Data Retention & Automated Deletion: Schools can delete individual pupils or classes at any time. Upon subscription expiry, accounts enter a 30-day read-only grace period for data export/renewal, followed by permanent automated erasure of all associated pupil and school records 90 days after expiry.

6. DPIA Risk Assessment Matrix

Identified Risk	Inherent Risk	Mitigation Control Implemented in SkyTyper	Residual Risk
Unauthorised person guesses a Class Code to view pupil names	Medium	Eliminated class roster dropdown on `/play`. Pupil login requires knowing Class Code + Pupil Username + 4-digit PIN, backed by IP rate-limiting.	Low (Minimal)
Exposure of sensitive pupil PII in the event of a breach	Medium	Strict data minimisation: no surnames, no emails, no DOBs, no addresses, and no SEN/medical data are stored in the database.	Low (Minimal)
Teacher accesses classes outside their responsibility	Low	Class-scoped RBAC restricts `teacher` accounts to classes explicitly assigned by the School Lead.	Low (Minimal)
Third-party trackers profiling pupils during school use	Medium	Server-side session guard suppresses all analytics and advertising scripts inside `/play` and school portals.	None

7. School DPO / Headteacher Approval Sign-Off

Based on the data minimisation controls, pseudonymous pupil architecture, and technical safeguards detailed above, residual risk to data subjects is assessed as LOW and does not require prior consultation with the ICO under Article 36 UK GDPR.

Approved on behalf of School / Trust

Name & Role: ________________________________________

Signature: __________________________________________

Date: _______________________________________________

Data Protection Officer (DPO) Review

DPO Name: ___________________________________________