DPIA support pack

Does the school need a DPIA?

The school decides, using ICO screening. Five Wells does not complete the school’s DPIA. The following features often push a school toward a DPIA:

• Processing children’s data at scale across a whole school.
• SEND / EHCP information (likely special category data).
• Use of Google Gemini to draft IEPs or lesson plans from pupil-related text, or the optional pupil Well helper.
• Public or corridor leaderboard URLs, even with initials-only mode.
• Voice notes, Photo Memories, or Journey making-proof photos.
• MIS sync via Wonde.

A credits-only school with no SEND Tracker and no AI may still want a short DPIA because it processes children’s data systematically. When SEND Tracker or AI is on, treat a DPIA as expected.

Description of processing (for the school to copy)

Five Wells is a multi-tenant web application. Each school’s rows are stored with a school identifier and protected by PostgreSQL row-level security so other schools cannot read them through the app. Staff sign in with email and password; schools may require TOTP MFA. Pupils may use email or school-issued PIN/QR flows designed not to store plaintext PINs in the application database.

Optional SEND Tracker lets staff turn EHCP text into IEP/ISP targets, record progress and provision, and capture pupil voice. Optional AI sends the text the staff member submits (which may include a pupil name and EHCP excerpt) to Google Gemini to produce a draft. Drafts are not used until staff save them. Default settings can purge stored EHCP source text after targets exist.

Consultation

• Consult the school DPO before enabling SEND Tracker or AI planner.
• Inform parents via the school’s privacy notice that a processor (Five Wells) and, if enabled, Google Gemini and/or Wonde are used.
• Do not require pupils to create consumer AI accounts.

Necessity and proportionality

The product is intended to replace scattered spreadsheets for recognition and SEND evidence. Schools should turn off modules they do not need (AI planner, photo memories, SEND Tracker, public leaderboard). Fair-use AI is part of a school licence; it is not a reason to send whole EHCP PDFs repeatedly if a shorter excerpt will do.

Risks to record in the school DPIA

• Unauthorised staff access — mitigate with MFA, role design, and prompt leaver offboarding.
• Over-collection — do not paste full EHCP documents if Section F/G excerpts suffice; enable purge-after-IEP.
• AI leakage or vendor processing — disable AI modules if the DPO does not accept Google as a sub-processor; never paste safeguarding case notes into the planner.
• Public leaderboard URL — treat the token like a password; use initials-only mode for signage.
• Exports — CSVs leave the platform; store them under the school’s own retention rules.

Measures Five Wells already implements (summary)

• Tenant isolation in the database (RLS), not only in the user interface.
• No service-role key in the browser; Auth Admin only on a small audited set of school-admin routes.
• Rate limiting on login and sensitive staff credential routes when Upstash is configured.
• School-scoped storage paths for uploads.
• Operator access limited by allowlist and platform MFA settings.

What the school must still do

• Name Five Wells (and enabled sub-processors) in parent privacy notices.
• Complete this DPIA with local context (age range, SEND cohort size, who holds admin rights).
• Decide whether Gemini-assisted SEND drafting or the pupil Well helper is acceptable.
• Set retention and offboarding (export then delete accounts when pupils leave, per school policy).
• Train staff not to record safeguarding allegations in credit notes or IEP free text.