A campus app holds data about every student who signs in to it, so your data protection officer will want the same answers from any supplier. These ten questions follow the ICO’s guidance. Several of the pages cited here (on contracts, DPIAs and AI) carry a note that they are under review after the Data (Use and Access) Act, so check for updates before you rely on them.
1. Is it a processor contract with everything Article 28 needs?
The ICO lists what a contract with a processor must set out: the subject matter and duration of the processing, its nature and purpose, the types of personal data and the people they relate to, and your obligations and rights as controller. It must also commit the supplier to processing only on your documented instructions, confidentiality, appropriate security, rules for sub-processors, helping you with people’s rights, helping you meet your own obligations (such as security, breach notification and DPIAs), end-of-contract provisions, and audits and inspections. Ask for the contract template before the demo, not after.
2. Who are the sub-processors, and where are they?
Ask for the full list of every company that will handle student data, what each does and where it does it, and how you will be told before one is added.
3. Does any student data leave the UK?
If it does, each restricted transfer needs a mechanism, and the ICO lists three: UK adequacy regulations, appropriate safeguards, or an exception. On safeguards, the ICO notes that “the EU SCCs are not valid on their own for restricted transfers under the UK GDPR”: the usual safeguards are the UK’s international data transfer agreement (IDTA) or the UK addendum to the EU clauses. For a US company relying on the UK Extension to the Data Privacy Framework, the ICO says you may only transfer to a business “that has an active status on the DPF list”. Check it.
4. Is student data used to train any AI model, and does the contract say so?
Ask the question in those words, and ask for the answer in the contract rather than on a web page. In its response to its consultations on generative AI, the ICO says that developers reusing personal data to train generative AI “must consider whether the purpose of training a model is compatible with their original purpose of collecting that data”, and that developing a generative AI model and developing an application based on it “constitute different purposes”.
5. Do we need a DPIA, and what will the supplier give us?
The ICO says a data protection impact assessment is required for processing that uses “innovative technologies, or the novel application of existing technologies (including AI)” combined with at least one other high-risk criterion from the European guidelines, and that “if in any doubt, we would always recommend that you do a DPIA”. An app with an AI assistant is likely to need one. Ask what the supplier provides towards it: a description of the processing, data flows, the risks it has identified and the measures it takes.
6. What security evidence is there?
Ask for current certificates and what they cover. Cyber Essentials covers five technical controls (firewalls, secure configuration, security update management, user access control and malware protection), and under PPN 014 suppliers must recertify every 12 months; Cyber Essentials Plus adds an independent test of the systems. Ask whether there is an independent penetration test of the app, and whether you can see its summary.
7. How is use reported to your staff?
Analytics about who read what can become a record of individual students. Ask whether reports are by name or by group, and whether small groups are suppressed so that no one can be singled out.
8. What happens when the contract ends?
Ask how your data comes back, in what format, how long deletion takes, whether backups are included, and whether you will have a written exit plan. End-of-contract provisions are one of the ICO’s required contract terms.
9. Is the supplier on the ICO’s register?
Most organisations that process personal information must pay the ICO’s data protection fee, and the ICO publishes a register of fee payers with each one’s name, address and registration reference. Being on it means the fee is paid; it is not a certification, so treat it as a basic check, not an assurance.
10. What will students be told?
Ask to see the privacy information the app will show students, and where it appears in the app, so that it is there before any data is collected.
Our answers
We publish Varsio’s answers to most of these: How does Varsio protect student data? covers our certificates, the contract, hosting, deletion and what comes before launch.