DATA PROTECTION IMPACT ASSESSMENT SUPPORT
The Sports I DPIA Information Pack, plus a checklist to help your school complete its own DPIA.
This pack supports your school's DPIA — Sports I does not complete the DPIA for you. The school remains responsible for its own assessment and sign-off.
Sports I DPIA Information Pack
Platform purpose
Sports I is a PE and school-sport platform for curriculum planning, assessment, evidence capture, reporting and school-sport management in primary and secondary schools.
Categories of personal data
- •Pupil names and class/year groupings
- •PE assessment records and teacher comments
- •Evidence media (photos/video) where uploaded by the school
- •Participation records for clubs, competitions and events
- •Staff names, roles and email addresses
Special category data
Sports I is not designed to store special category data. Where a school records SEND-related information in free-text fields (for example, to support inclusive PE), the school controls what is entered and must apply its own lawful basis and safeguards.
Images and video
Evidence media is uploaded by school staff only. Consent status, visibility restrictions and retention are controlled by the school — see Safeguarding and the retention schedule.
Children's data
Most data subjects are children. Schools act as controller and are responsible for lawful basis, consent (where relied on) and privacy notices to parents. Sports I supports the school with export, correction and deletion requests.
User roles
Access is role-based: organisation admin, headteacher, PE lead, teacher, coach, teaching assistant and viewer roles, plus parent/pupil access only where the school enables it.
Data flows
Teacher → Sports I web app → secure database → evidence storage → reporting engine. Each school's data is isolated by a school-level tenant boundary enforced across the platform.
Storage
Application hosting, database and media storage are provided by our platform provider. Residency details are shown in the subprocessor register until verification completes.
Subprocessors
A short, published register of providers — see the Subprocessors page for current entries and verification status.
Retention
The retention schedule sets retention periods and deletion triggers per data category. Schools can request earlier deletion at any time.
Access controls
Role-based permissions, per-school tenant isolation and least-privilege defaults. See the Access & Permissions page.
AI processing
AI assists drafting (reports, lessons, adaptations) but never makes final pupil judgments or publishes anything without staff review. See the AI Governance page.
Risk controls
Tenant isolation, role-based access, restricted evidence visibility defaults, and no public access to pupil data.
Deletion process
Deletion requests are confirmed in writing, state exactly what will be deleted and what is retained and why, and are carried out to the retention schedule.
Incident handling
A documented detect–contain–assess–notify process. Where a school's data is affected, the school is notified so it can meet its UK GDPR duties.
School DPIA checklist
A practical checklist to help your DPO complete your school's own DPIA. Print or copy this into your DPIA template.
- Identify your school's lawful basis for each processing purpose (public task / legitimate interests / consent as your DPO advises).
- Record Sports I in your school's Record of Processing Activities (ROPA).
- Review the Sports I subprocessor register and note any providers already on your school's approved list.
- Decide your school's policy on evidence photos and video, including consent capture and who may upload.
- Confirm which user roles your school will assign and to whom (least privilege).
- Note the retention schedule and align it with your school's retention policy.
- Record how parents are informed (privacy notice) and how data subject requests will be handled with Sports I's support.
- Document your school's incident escalation contact for Sports I data concerns.
- Confirm whether your school will enable parent/pupil access and the controls that apply.
- Review the Data Processing Agreement once issued, and record its status in your DPIA.