School DPIA Template

Product: Lumi Tutor Controller: [CONTROLLER_NAME] Processor: [COMPANY_LEGAL_NAME] Prepared by: [DPIA_OWNER] Reviewed by: [DPO_NAME] Date: [LAST_UPDATED_DATE]

Not legal advice. This template helps a school or school operator assess Lumi Tutor. A school controller must adapt it to its own national law, role, pupils, and deployment.

1. Decision

Question	Answer
Is this DPIA complete?	No
Can the school run a controlled pilot?	No, until all Phase 1 blockers are closed
Can the school use Lumi for grading, admission, placement, discipline, proctoring, or certification?	No
Required human owner	[SCHOOL_DPO_OR_OWNER]

2. Processing description

Lumi Tutor provides formative tutoring, practice, feedback, and parent/teacher visibility. It must not make official school decisions.

Data subjects

Students/children.
Parents or guardians.
Teachers.
School administrators.

Data categories

Parent/teacher account identifiers.
Child first name or nickname.
Child age, language, country, learning preferences, and school/year context.
Tutor messages and generated responses.
Summary-only learning memory by default.
Safety events.
Learning progress and practice metadata.
Technical logs, IP address, user agent, authentication events.

Data not collected by design

Child last name unless a school contract explicitly requires roster import.
Child home address.
Child phone number.
Exact geolocation.
Advertising identifiers.
Religious affiliation, belief status, or denomination as a child profile attribute.
Biometric identification data.
Official grades, disciplinary records, admissions files, or special-education diagnoses.

3. Purposes

Purpose	Allowed?	Notes
Formative tutoring and practice	Yes	Primary use.
Teacher insight into practice and progress	Pilot-only	Must not become final grading.
Parent visibility and safety review	Yes	Parent dashboard and safety escalation.
Official grading	No	High-risk AI Act path if ever considered.
Admission, placement, tracking, or progression	No	High-risk AI Act path if ever considered.
Discipline/proctoring/behaviour monitoring	No	Out of scope.
Advertising or profiling	No	Out of scope.

4. Roles and lawful basis

Role	Expected model
School	Controller for school deployment, unless a different signed arrangement says otherwise.
Lumi operator	Processor under school instructions.
Parent/family use	Lumi operator may be controller for direct family service.

The school must document its lawful basis under its national law. Depending on the country and school type, this may involve public task, legal obligation, contract, legitimate interests, or consent. Lumi must not choose the lawful basis on behalf of the school.

5. Necessity and proportionality

Check	Required answer
Is the use limited to tutoring and practice?	Yes
Is summary-only memory the default?	Yes
Can transcripts be disabled?	Yes
Can parents/guardians get visibility where required?	Yes
Can a student use a non-AI alternative?	School to define
Can the school delete/export data?	Required before pilot
Are official decisions made by humans outside Lumi?	Yes

6. Risks

Risk	Likelihood	Impact	Controls	Status
Child data processed without valid authority	Medium	High	Parent/school authority workflow, country matrix, audit trail	Open
AI output gives harmful, unsafe, or age-inappropriate guidance	Medium	High	Safety classifier, blocked categories, escalation, parent/teacher reporting	Open
Tutor answer becomes unofficial grading or placement	Medium	High	Contract ban, UI wording, teacher training, report disclaimers	Open
Special-category data appears in chat	Medium	High	No solicitation, minimisation, redaction, retention controls, reporting	Open
Religious/private school content mishandled	Medium	High	Approved religious/private-school policy and content boundaries	Open
Cross-tenant data exposure	Low	High	Tenant isolation, access controls, audit logs, tests	Open
Accessibility barrier excludes students	Medium	Medium	WCAG 2.2 AA audit and remediation	Open
International transfer without adequate safeguards	Medium	High	Subprocessor review, SCCs, transfer impact assessment	Open
Excessive retention	Medium	Medium	Retention schedule, deletion/export flows	Open

7. Required evidence before pilot

Signed pilot agreement.
Signed DPA.
Completed school-specific DPIA.
Approved subprocessor list.
Completed transfer assessment.
Local minor consent/authority review.
AI Act risk-register classification.
Accessibility audit plan.
Parent/guardian communication template.
Teacher acceptable-use guide.
Incident escalation contact list.
Data deletion/export test.

8. Prior consultation

If residual high risk remains after mitigation, the school/controller must decide whether supervisory-authority consultation is required under GDPR Article 36 or national law.

9. Approval

Role	Name	Decision	Date
School owner	[SCHOOL_OWNER]	Pending	[DATE]
School DPO/privacy lead	[SCHOOL_DPO_OR_OWNER]	Pending	[DATE]
Lumi legal	[LEGAL_OWNER]	Pending	[DATE]
Lumi security	[SECURITY_OWNER]	Pending	[DATE]
Lumi product	[PRODUCT_OWNER]	Pending	[DATE]

School DPIA Template

Product: Lumi Tutor Controller: [CONTROLLER_NAME] Processor: [COMPANY_LEGAL_NAME] Prepared by: [DPIA_OWNER] Reviewed by: [DPO_NAME] Date: [LAST_UPDATED_DATE]

Not legal advice. This template helps a school or school operator assess Lumi Tutor. A school controller must adapt it to its own national law, role, pupils, and deployment.

1. Decision

Question	Answer
Is this DPIA complete?	No
Can the school run a controlled pilot?	No, until all Phase 1 blockers are closed
Can the school use Lumi for grading, admission, placement, discipline, proctoring, or certification?	No
Required human owner	[SCHOOL_DPO_OR_OWNER]

2. Processing description

Lumi Tutor provides formative tutoring, practice, feedback, and parent/teacher visibility. It must not make official school decisions.

Data subjects

Students/children.
Parents or guardians.
Teachers.
School administrators.

Data categories

Parent/teacher account identifiers.
Child first name or nickname.
Child age, language, country, learning preferences, and school/year context.
Tutor messages and generated responses.
Summary-only learning memory by default.
Safety events.
Learning progress and practice metadata.
Technical logs, IP address, user agent, authentication events.

Data not collected by design

Child last name unless a school contract explicitly requires roster import.
Child home address.
Child phone number.
Exact geolocation.
Advertising identifiers.
Religious affiliation, belief status, or denomination as a child profile attribute.
Biometric identification data.
Official grades, disciplinary records, admissions files, or special-education diagnoses.

3. Purposes

Purpose	Allowed?	Notes
Formative tutoring and practice	Yes	Primary use.
Teacher insight into practice and progress	Pilot-only	Must not become final grading.
Parent visibility and safety review	Yes	Parent dashboard and safety escalation.
Official grading	No	High-risk AI Act path if ever considered.
Admission, placement, tracking, or progression	No	High-risk AI Act path if ever considered.
Discipline/proctoring/behaviour monitoring	No	Out of scope.
Advertising or profiling	No	Out of scope.

4. Roles and lawful basis

Role	Expected model
School	Controller for school deployment, unless a different signed arrangement says otherwise.
Lumi operator	Processor under school instructions.
Parent/family use	Lumi operator may be controller for direct family service.

5. Necessity and proportionality

Check	Required answer
Is the use limited to tutoring and practice?	Yes
Is summary-only memory the default?	Yes
Can transcripts be disabled?	Yes
Can parents/guardians get visibility where required?	Yes
Can a student use a non-AI alternative?	School to define
Can the school delete/export data?	Required before pilot
Are official decisions made by humans outside Lumi?	Yes

6. Risks

Risk	Likelihood	Impact	Controls	Status
Child data processed without valid authority	Medium	High	Parent/school authority workflow, country matrix, audit trail	Open
AI output gives harmful, unsafe, or age-inappropriate guidance	Medium	High	Safety classifier, blocked categories, escalation, parent/teacher reporting	Open
Tutor answer becomes unofficial grading or placement	Medium	High	Contract ban, UI wording, teacher training, report disclaimers	Open
Special-category data appears in chat	Medium	High	No solicitation, minimisation, redaction, retention controls, reporting	Open
Religious/private school content mishandled	Medium	High	Approved religious/private-school policy and content boundaries	Open
Cross-tenant data exposure	Low	High	Tenant isolation, access controls, audit logs, tests	Open
Accessibility barrier excludes students	Medium	Medium	WCAG 2.2 AA audit and remediation	Open
International transfer without adequate safeguards	Medium	High	Subprocessor review, SCCs, transfer impact assessment	Open
Excessive retention	Medium	Medium	Retention schedule, deletion/export flows	Open

7. Required evidence before pilot

Signed pilot agreement.
Signed DPA.
Completed school-specific DPIA.
Approved subprocessor list.
Completed transfer assessment.
Local minor consent/authority review.
AI Act risk-register classification.
Accessibility audit plan.
Parent/guardian communication template.
Teacher acceptable-use guide.
Incident escalation contact list.
Data deletion/export test.

8. Prior consultation

If residual high risk remains after mitigation, the school/controller must decide whether supervisory-authority consultation is required under GDPR Article 36 or national law.

9. Approval

Role	Name	Decision	Date
School owner	[SCHOOL_OWNER]	Pending	[DATE]
School DPO/privacy lead	[SCHOOL_DPO_OR_OWNER]	Pending	[DATE]
Lumi legal	[LEGAL_OWNER]	Pending	[DATE]
Lumi security	[SECURITY_OWNER]	Pending	[DATE]
Lumi product	[PRODUCT_OWNER]	Pending	[DATE]

Launch into the next idea.

School DPIA Template

Private test build — draft notice

School DPIA Template

1. Decision

2. Processing description

Data subjects

Data categories

Data not collected by design

3. Purposes

4. Roles and lawful basis

5. Necessity and proportionality

6. Risks

7. Required evidence before pilot

8. Prior consultation

9. Approval

School DPIA Template

Private test build — draft notice

School DPIA Template

1. Decision

2. Processing description

Data subjects

Data categories

Data not collected by design

3. Purposes

4. Roles and lawful basis

5. Necessity and proportionality

6. Risks

7. Required evidence before pilot

8. Prior consultation

9. Approval