GDPR and MFL platforms: a practical school procurement and DPIA checklist

The words in a supplier contract matter, but the actual roles depend on who determines the purposes and essential means of the processing.

In a normal school teaching workflow, a common model is:

• the school decides why pupil data is being processed and which pupils use the platform;
• the supplier processes the teaching data on the school’s behalf under the service agreement.

The ICO’s guidance says controller/processor status depends on the real decision-making relationship, not simply the label chosen by the parties.

Grade 9 School’s documented posture for ordinary school teaching data is that the school is the controller and Grade 9 School Ltd acts as processor. Grade 9 may act as controller for its own company administration records such as business contacts, invoices and statutory accounting records.

Schools should still check that the contract reflects the actual use they intend.

Ask the supplier to list what it processes and why.

For a language platform, categories might include:

The point is not to create the longest possible inventory. It is to expose what is actually necessary.

The ICO’s data-minimisation principle asks organisations to limit personal data to what is necessary.

Ask:

• Does the platform need pupil names?
• Does it need pupil email addresses?
• Can the school use pseudonymous identifiers?
• Can the school keep any real-name mapping internally?
• Is a direct identifier required for support or merely convenient?

Grade 9 School does not require pupil email addresses for its teacher-created username/password route. Schools can also choose a pseudonymous account model.

That should be described as data minimisation, not anonymisation. Account, class, assignment, submission and progress records can still be personal data when the school can link them back to a pupil.

For a detailed treatment, see the related guide on pupil accounts without email.

A privacy review should include what happens when a pupil cannot sign in.

Ask:

• Who creates pupil accounts?
• Are pupils expected to self-register?
• Is school email/SSO required?
• Who can reset credentials?
• Can existing passwords be viewed?
• How are bulk login sheets handled?
• What happens when a pupil changes class?

A secure account design is not just a sign-in screen. It includes the recovery and support path.

“Hosted in the UK” is not a complete infrastructure answer.

Ask for:

• the location of the primary teaching database;
• where backups are managed;
• whether the supplier keeps another off-platform copy;
• the intended restore/recovery location;
• whether a separate multi-region standby exists;
• which services host the front end rather than the core database.

The current Grade 9 School reference position is:

• core backend/database: Supabase on AWS eu-west-2, London;
• database backups: managed by Supabase for that project;
• separate off-platform backup maintained by Grade 9: no;
• intended restore location: the same Supabase/AWS London region unless otherwise specifically agreed;
• separate multi-region standby database: no;
• web application hosting/deployment: Netlify.

That is deliberately more precise than claiming “all data stays in the UK”, because optional AI processing is a separate data flow.

If a platform contains AI-supported tools, do not assume the main database location describes the AI processing location.

Ask:

• Which AI provider is used?
• Which features use it?
• What pupil/teacher data is sent?
• Is audio or an image sent?
• Is direct identifying data necessary?
• What do the provider terms say about training/product improvement?
• Where can processing occur?
• What logging/cache/retention can occur?
• Can ordinary platform use continue without invoking AI?

Grade 9 School’s current position is that some optional features use the paid Google Gemini API, including resource generation, listening/audio activity generation and teacher-controlled writing/speaking feedback.

The school-facing position does not say that AI processing is UK-only. It describes Google-managed service infrastructure and acknowledges that relevant data may be processed, stored transiently or cached where Google or its agents maintain facilities.

The paid-service terms relied on by Grade 9 state that submitted prompts/files/responses are not used to improve Google’s products. That statement should be rechecked against the current applicable terms before final publication or a procurement decision.

A list of company names is less useful than a list that says what each one does.

For the current Grade 9 School architecture, the relevant school-facing summary is:

A supplier should also explain the distinction between its own chosen sub-processors and a vendor’s broader authorised supplier list. A vendor listing a company in its own documentation does not by itself prove that the school platform sends pupil data to that company for a particular workflow.

Avoid vague statements such as “data is deleted when no longer needed” unless the supplier can turn that into a workable process.

Ask:

• How long is teaching data retained during the licence?
• What happens after the licence ends?
• Can the school request earlier deletion?
• What is deleted or anonymised from the live system?
• How quickly?
• What may remain in managed backups or provider logs?
• How are statutory finance records treated separately?

Grade 9 School’s current school-facing position is:

• teaching data is retained for the licence term;
• after licence end, the default retention period is up to 90 days unless the school asks for deletion sooner;
• on written request, relevant pupil/class teaching data is to be deleted or anonymised from the live system within 30 days, subject to legal/accounting obligations;
• data in managed backups or vendor-side logs/cache may remain temporarily until normal retention cycles expire.

That is why Grade 9 does not claim instant deletion from every backup or provider system.

The ICO says a controller using a processor needs a written contract or other legal act.

The contract should describe the processing and include the Article 28 terms, including matters such as:

• documented instructions;
• confidentiality;
• appropriate security;
• sub-processors;
• data-subject rights;
• assistance to the controller;
• end-of-contract provisions;
• audit/inspection obligations.

Grade 9 School can provide a Grade 9 School Ltd DPA draft for school review. If a school has its own preferred DPA template, the current posture is to review that instead where appropriate.

A DPA is not a decorative attachment. It should describe the service the school is actually buying.

The ICO describes a DPIA as a process to identify and minimise the data-protection risks of a project. A DPIA is required where processing is likely to result in a high risk to individuals.

Schools should apply their own governance and DPO judgement to the intended use.

A useful DPIA describes:

• the nature, scope, context and purposes of the processing;
• necessity and proportionality;
• risks to individuals;
• measures to reduce those risks.

For an MFL platform, do not skip speaking audio or AI-supported feedback merely because most of the platform is ordinary vocabulary and grammar practice.

Map the actual workflows the school intends to use.

Security should be risk-based, not reduced to a badge.

Ask about:

• access control;
• authentication;
• encryption in transit and at rest where relevant;
• vulnerability management;
• backup/recovery;
• incident handling;
• staff/admin access;
• supplier security documentation.

The ICO requires appropriate technical and organisational measures relative to the risks of the processing.

A school may reasonably ask for vendor security evidence without expecting a small supplier to hand over unrestricted access to private infrastructure or confidential audit reports.

“We do not process personal data.”

Ask how pupil accounts, class membership, submissions and progress are linked.

“Everything is stored in the UK.”

Ask separately about the core database, backups, analytics, email services and AI processing.

“Everything is deleted instantly.”

Ask about the live database, managed backups, logs/cache and legal/accounting records.

“We are fully GDPR compliant.”

Ask for the actual data flows, contracts, security measures, retention and deletion process instead of treating a blanket statement as evidence.

For school procurement records, the current company identity is:

• Grade 9 School Ltd
• Company number 17153287
• Registered in England and Wales
• Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
• Current ICO registration: ZC226583

ICO registration is an administrative fact. It is not presented here as a certification that every possible school use or configuration is automatically compliant.

The school must still assess its own intended processing.