Data Protection Impact Assessment

Version: October 2026. Prepared by Educoda Ltd for schools using P16 Enrolment.

How to use this template

Educoda has pre-filled everything it knows about how P16 processes data, so your Data Protection Officer only needs to check it and complete the parts marked [School to complete]. The structure follows the ICO's sample DPIA template.

• Sections 1 to 8 describe the processing. Edit anything that does not match how your school will use P16.
• Section 9 lists the risks Educoda has identified and the controls in place. Add any risks specific to your school.
• Section 10 is your school's sign-off.

Questions about anything in this document: [email protected].

1. Why a DPIA is needed

A DPIA is needed because P16 processes children's personal data, including special category data, using a new technology supplier. Under UK GDPR Article 35 and ICO guidance, processing children's data and sensitive data at scale is likely to be high risk.

• Project: online sixth form admissions and enrolment using P16, from first application to enrolment day.
• Supplier: Educoda Ltd (company 16434698), ICO registration ZB949031.
• School: [School to complete: name, URN, DPO name]
• Start of processing: [School to complete: e.g. applications open date]

2. Nature of the processing

Students apply online through P16, and their data reaches the school in two stages so that the school only sees what it needs at each point.

1. Profile. The student creates a P16 account and profile. Educoda holds this profile as controller.
2. Application. When the student applies, the school receives only the data relevant to its published admission arrangements (Admissions Code mode). Educoda processes this on the school's behalf.
3. Enrolment. When the student submits their enrolment (usually on GCSE results day), the rest of the profile is released to the school.
4. Transfer to MIS. The school exports enrolled students to its management information system as a CTF or ATF file, the DfE's standard transfer formats. Wonde is used only to import students into P16.

How data is collected: directly from students and parents through online forms and uploads; from referees through a secure link; from the school (decisions, meeting notes, imported results); from the school's MIS through Wonde, where the school connects it; and, where the school requests it, from the DfE's View Education Record service.

How data is used: checking applications against entry requirements, scheduling interviews and taster days, sending emails, taking deposits through Stripe, checking results on results day, and enrolment.

Automated processing: P16 can check grades against the school's entry requirements and apply the school's rules automatically. Enrolment decisions are made by school staff, and students can ask for any automated outcome to be reviewed.

3. Scope of the processing

Data subjects: prospective sixth form students (mostly aged 15 to 17), their parents or carers, and referees (teachers).

Expected volume: [School to complete: approximate applications per year and Year 12 PAN]

Schools not bound by the School Admissions Code (for example FE colleges) can switch off Admissions Code mode and receive the full profile at application.

Retention (from Educoda's privacy policy):

Encrypted database backups are kept for up to 13 weeks. [School to complete: confirm these match your records retention schedule, or tell Educoda your required periods.]

4. Context

Most data subjects are children, so the processing needs extra care, plain-language information and strong limits on who sees what.

• Expectations: students and parents expect to apply to a sixth form online and would not expect sensitive details to influence an admissions decision.
• School Admissions Code: P16's Admissions Code mode is on by default. Until a student enrols, staff cannot see special category data, references, or other data unrelated to the published admission arrangements, and admissions rules cannot use them.
• Student control: students can edit their own profile, withdraw consent for special category data before enrolment, and reuse one profile across several schools.
• Marketing: Educoda does not market to students or parents.
• Prior concerns: [School to complete: any previous complaints or incidents relating to admissions data]
• Supplier maturity: P16 has run admissions at Brampton Manor Academy since 2018 and processed over 15,000 applications across the last three cycles. Educoda Ltd was formed in 2025. Cyber Essentials certification is in progress.

5. Purposes

The school uses P16 to run a fair, efficient and lawful sixth form admissions process.

• Receive complete, validated applications without re-keying paper forms.
• Apply published entry requirements consistently to every applicant.
• Organise interviews, taster days and results day appointments.
• Confirm places and enrol students with the information needed to support and safeguard them.
• Transfer enrolled students' records to the school MIS and meet statutory reporting duties.

Benefits: less manual handling of paper and spreadsheets, fewer data entry errors, an audit trail of decisions, and sensitive data withheld from admissions decisions. [School to complete: any benefits specific to your school]

6. Roles and lawful basis

The school is the controller for the application and enrolment data it receives, and Educoda is its processor. Educoda is a separate, independent controller for the student's P16 account and profile.

Contract: Educoda processes data for the school under the Data Processing Agreement at Schedule 1 of its School Services Agreement, which covers UK GDPR Article 28 terms and is sent with the quote.

Privacy information: Educoda's privacy policy is at p16.uk/privacy-policy. [School to complete: update your own privacy notice to name P16 as a processor for admissions]

7. Sub-processors and international transfers

All student data is stored in the UK or EEA. The only transfers outside it are network traffic through Cloudflare's global network and payment data through Stripe, both covered by recognised safeguards. Web font and code library providers also receive visitors' IP addresses when pages load, but no account or profile data.

Educoda gives the school 30 days' notice before adding or replacing a sub-processor.

8. Necessity and proportionality

The processing is necessary to run admissions online, and P16 limits each party to the minimum data it needs at each stage.

• Data minimisation: in Admissions Code mode, staff see only data relevant to the published admission arrangements until enrolment.
• Purpose limitation: data is used only for admissions, enrolment and running the service. Educoda does not sell data or market to students or parents.
• Accuracy: grades are checked against entry requirements as they are entered, UPNs are format-checked, and results can be verified through the DfE's View Education Record service.
• Retention: fixed periods as set out in section 3, or as the school instructs.
• Data subject rights: students can correct their profile themselves and request access, erasure or export by email. Educoda passes requests about school-held data to the school.
• Alternatives considered: [School to complete: e.g. paper forms, Google Forms, other suppliers, and why P16 was chosen]

9. Risks and mitigations

Educoda assesses every identified risk as low once its controls are in place. The school should review each rating and add risks specific to its own setting.

10. Sign-off

[School to complete this section.]