Last updated: 11 September 2026 · Status: draft, pending a solicitor's sign-off
This is a summary of our own Data Protection Impact Assessment (DPIA) for The School Gallery, published so your school can draw on it for your own – you remain the data controller, and UK GDPR Article 35 still expects you to carry out your own assessment for how you use the platform; this document is support for that, not a substitute for it. It was prepared with AI assistance from our own system design and hasn't yet had a solicitor's or a named DPO's sign-off – treat it as a working draft rather than a finalised compliance record until it has.
The platform involves systematic, large-scale processing of photographs and personal data belonging predominantly to children – one of the categories the ICO's own screening criteria flags as needing an assessment before processing begins, regardless of how the data is used afterwards.
Nature: a cloud-hosted, multi-tenant platform. School staff upload event photos and tag which pupils appear in each one. A photo only becomes downloadable once every tagged pupil's family has granted consent – a single denial removes it permanently for every family, not just the one that denied it.
Scope: one school's data is isolated from every other school's by default at the database query level, not left to individual code paths to remember to filter correctly.
Context: UK primary and secondary schools; the data subjects are predominantly children, with parents acting as the decision-maker for consent.
Purpose: to let a school share event photography with parents in a way that's auditable and enforceably consent-gated, sync pupil rosters from the school's MIS, and – optionally – offer print ordering and staff single sign-on.
This draft was prepared internally and, given the current scale of processing, we've assessed that a formal Data Protection Officer designation under Article 37 isn't currently required – this is a deliberate, documented decision, kept under review as the business grows, rather than an oversight. We intend to have this document itself reviewed by external legal counsel before relying on it for certification purposes. A school adopting the platform should consult their own DPO as part of their own DPIA for this specific use.
Alongside this summary, we maintain (but don't publish in full, since they're accountability records rather than customer-facing documents) a Records of Processing Activities register under Article 30, and a documented breach-notification procedure covering the 72-hour ICO reporting clock and the criteria for notifying affected families directly. Both are available to a school's own DPO on request.
We're a UK-only service today – every current and prospective school we work with is UK-based – so EU GDPR's extraterritorial provisions (including appointing an EU representative under Article 27) don't currently apply. We'll revisit this the moment that changes.
Data collection is scoped to what the service needs, not the maximum available: pupil name, date of birth, and year group are synced for tagging purposes, not health, special educational needs, or other special category data. GPS location and other embedded metadata is stripped from every photo automatically on upload – a photo taken at a school never carries the address it was taken at once it reaches this platform. Email addresses are stored encrypted with a one-way lookup index, so day-to-day operation never needs to decrypt the readable value.
The lawful bases relied on: consent for releasing any individual photo; contract performance for operating an account on the school's behalf; legitimate interest for security logging, weighed against the individual's right to privacy; and legal obligation for records the law requires us to keep (billing, audit trails).
The ICO's Age Appropriate Design Code applies because the service processes children's personal data, even though – deliberately – no pupil ever holds an account or interacts with the platform directly; every interaction runs through a verified parent or a member of school staff. That means the Code's standards aimed at a child's own use of an interface (default settings a child controls, nudge techniques, connected device/toy rules) have limited direct application here, since there's no child-facing interface for them to govern. The standards that do apply regardless of who the direct user is – data minimisation, purpose limitation, a DPIA for high-risk processing, transparency, and parental-control mechanisms – are addressed throughout this document: see section 4 above and the retention/access controls in section 6.
The core design risk of the whole service. Mitigated structurally, not just procedurally: a photo's full-resolution original is never reachable until every tagged pupil's family has actively granted – one missing decision blocks it for everyone. Pre-consent, only a low-resolution, visibly watermarked preview is ever served. Every download also carries an invisible, per-viewer forensic mark – including a staff member's own view of the original, not just a parent's – so a leaked copy can still be traced back to who accessed it. A parent can also directly report a specific photo as a concern, which removes it for every family instantly and alerts both us and the school.
Tagging is staff-controlled and editable after upload; changing a photo's tags re-triggers a fresh consent decision for anyone newly tagged, rather than silently exposing an already-consented photo to someone who's never been asked.
Every tenant-owned record is scoped to its school by a global query rule applied automatically, not a per-query convention a future change could forget. The one deliberate exception – our own support staff impersonating an account for diagnostics – is fully and separately audited, recording both the impersonated identity and the real member of staff behind it.
Multi-factor authentication is available on every account type; every login is rate-limited per account and per network address; passwords are checked against known-breached password lists at set time; every login, view, and download – including a staff member viewing a photo's own file, not just a parent's – is logged against the account that performed it. Residual risk is rated medium rather than low because MFA enrolment itself isn't yet mandatory for every role – an account that never turns it on carries more risk than one that does.
Every upload is virus-scanned and re-encoded before it's ever stored (see below), but that scan checks for malware, not image content – there's currently no hash-matching against known illegal-image lists (e.g. IWF membership). Weighed against the fact that photos come from vetted school photographers and staff rather than open public upload, we've assessed this as a real but lower-probability residual risk than a typical open-upload platform would carry, and are evaluating IWF membership as a further mitigation rather than treating the current position as final.
Each sub-processor (see the register) receives only what it needs to do its specific job – for example, our accounting provider never receives a single parent's personal data, and our payment provider never routes card details through our own servers at all. Each engagement sits under its own data processing terms. This risk can never fall to zero while sub-processors exist at all, which is exactly why the register stays public and current.
Photo retention is configurable per school and enforced automatically – photos are permanently deleted once the period lapses, with a reminder email first if a consented photo hasn't been downloaded yet. Security and audit logs are pruned on a rolling schedule rather than kept indefinitely.
The service is currently parent-mediated by design – every consent decision runs through a verified parent account. That's a deliberate, lower-risk starting posture, but it does mean a pupil's own record can't be erased on a single parent's say-so alone; that has to go through the school directly. Worth revisiting if the platform ever offers pupils their own direct login.
On the basis of the measures above, the processing is assessed as proceeding with residual risk managed to a level proportionate to its purpose – subject to the formal review noted at the top of this page. We'll update this assessment whenever we make a material change to how photos or pupil data are processed, and welcome a school's own DPO reviewing it alongside their procurement decision.
Contact dataprotection@theschoolgallery.co.uk – we're glad to walk your DPO through any part of this alongside our sub-processor register, safeguarding & security assurance statement, and privacy policy.