DPIA Checklist
Data Protection Impact Assessment (DPIA)
Project Name: AtTech 360 Tours Data Controller: [Insert School Name] Data Processor: AtTech 360 Tours
1. Overview
This DPIA is designed to identify and minimize the data protection risks associated with the creation and hosting of interactive 360-degree virtual tours in a school environment. Conducting this DPIA is a requirement under the UK GDPR when processing is "likely to result in a high risk to the rights and freedoms of natural persons", particularly given the involvement of children.
2. Description of Processing
- What is the nature of the processing? AtTech 360 Tours captures high-resolution panoramic photographs of the school premises. In higher-tier packages, this includes capturing interactive video, audio, and digital work of students. The compiled media is structured into an interactive web application and hosted on secure UK servers.
- How will data be collected? Via professional 360-degree cameras, traditional video cameras, and digital screen-recording software (for student iPad work).
- How will data be stored? Raw assets are transferred via SFTP (Port 22) to encrypted local workstations for editing. Final published files are hosted on Krystal Hosting Ltd's UK servers utilizing NVMe SSD encryption and TLS 1.2+ transit encryption.
3. Necessity and Proportionality
- Why is the data being processed? To provide prospective parents, students, and stakeholders with an immersive, transparent view of the school's facilities and active learning environment.
- Is the processing proportionate to the purpose? Yes. Visual data is inherently required to produce a virtual tour. The use of a "Dual-Layer Consent Model" ensures that students only appear in a manner strictly authorized by their guardians, ranging from background ambient inclusion to specific interactive features.
4. Assessment of Risks to Data Subjects
| Risk Description | Likelihood | Severity | Overall Risk |
|---|---|---|---|
| Unauthorized interception of data during transit from school to AtTech 360. | Low | High | Medium |
| Accidental publication of non-consenting student in a background panorama. | Medium | High | Medium |
| Identification of a student by external malicious actors using tour data. | Low | High | Medium |
| Data stored outside the UK subject to foreign surveillance. | Low | High | Low |
5. Mitigation Measures (Risk Treatment)
The following controls are implemented to reduce the identified risks to an acceptable level:
- Secure Data Transfer: All physical media is wiped from memory cards immediately after encrypted transfer to AtTech workstations. Web transfers utilize SFTP.
- Dual-Layer Consent & School Management: The School takes absolute responsibility for filtering non-consenting students prior to the shoot. AtTech 360 provides a clear Parental Consent Form to facilitate this.
- Anonymization / Restriction: Surnames are strictly forbidden in audio/video features. Any non-consenting student accidentally captured will have their face digitally blurred via post-processing before the tour goes live.
- Data Sovereignty: AtTech 360 strictly uses Krystal Hosting Ltd (Emerald Tier), guaranteeing 100% data residency within the UK, mitigating cross-border transfer risks.
- No Indexing: If required by the school, tours can be placed behind password protection or
noindexheaders can be applied to prevent search engines from parsing the media.
6. DPIA Sign-off
By signing below, the School acknowledges the risks and agrees that the mitigation measures provided by AtTech 360 Tours are sufficient to proceed under the UK GDPR.
Data Protection Officer (School):
Name: _________________ Date: _________________
Lead Producer (AtTech 360 Tours):
Name: Richard Poth Date: _________________