DPIA Data Protection Impact Assessment - User Guide for Oak’s Platform

Oct 21, 2026

Uploaded by Theodore

User guide for completing a Data Protection Impact Assessment (DPIA) for Oak’s platform, supporting compliance with data protection laws and helping ensure safe, secure use by teachers and other users. The guide explains when and how to perform a DPIA, referencing ICO guidance and a DPIA template, and directs readers to related platform policies covering terms, privacy, and cookies, including AI-related materials. It details hosting, security and privacy threat mitigation, governance approach, and the organizational and technical controls used across the main site, AI experiments, and curriculum API.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages8

Reading Time20 min

AccessFree to download

Completing a DPIA for Oak’s platform

Related policies and where to find information

Platform overview: hosting and services

AI Experiments site: hosting and tools

Curriculum API: hosting and tools

Detecting and mitigating security and privacy threats

Compliance with data protection legislation

User guide for completing a Data Protection Impact Assessment on Oak’s platform This guide will help you carry out a Data Protection Impact Assessment (DPIA) of our platform, so that you can comply with your obligations under data protection laws and be assured that our platform is safe and secure for use by your teachers and others. The Information Commissioner’s Office (ICO) provides guidance on when and how to complete a DPIA and a DPIA template. Read this guide alongside the policies listed below which set out detailed information about our platform, including Aila, our AI-powered lesson assistant and the personal data we handle. Terms and Conditions ( main site and AI experiments) Privacy Policy (all sites) Cookie Policy ( main site) Cookie Policy (Aila site) Terms and Conditions (Curriculum API) Cookie Policy (Curriculum API) If these documents, combined with this guide, do not fully answer any questions you have, [please contact our Data Protection Officer at](please contact our Data Protection Officer at dpo@thenational.academy)[ ](please contact our Data Protection Officer at dpo@thenational.academy)[dpo@thenational.academy](please contact our Data Protection Officer at dpo@thenational.academy), who will be happy to help. Information about our platform Our main website is [https://www.thenational.academy/](https://www.thenational.academy/. This)[. This](https://www.thenational.academy/. This) is where you can access and download our lesson planning and teaching resources. We also have the Oak AI Experiments site ([https://labs.thenational.academy/](https://labs.thenational.academy/)). Using a log-in, you can access Aila, our AI-powered lesson assistant. For third party organisations who want to integrate Oak’s openly licensed curriculum and lesson content, we also have the Oak Curriculum API ( [https://open-api.thenational.academy/](https://open-api.thenational.academy/)). Information you may require to complete your DPIA Who hosts our platform? Our main website: ● It is hosted on Vercel in the public cloud. ● The following additional tools are used: ○ Google Cloud Platform (for hosting and management of the application database and downloadable lesson resources (slides, worksheets, video transcripts, etc.) . ○ Google Drive (for hosting the lesson content (slides and worksheets) ○ Hasura Cloud (for delivery of data to the site via an API) ○ Mux (for hosting and streaming of videos) ○ ElasticCloud (for search functionality) ○ Sanity CMS (for blog posts and associated content) ○ Cloudinary (for hosting and managing lesson media such as images and audio) Our AI Experiments site: ● It is hosted on Vercel in the public cloud. ● The following additional tools are used: ○ Google Cloud Platform (our application databases, which are managed by ScaleGrid) ○ Prisma Accelerate (database performance, including connection pooling and query caching) ○ Third-party LLM provider, currently OpenAI GPT-5 .4Mini Our Curriculum API and associated website: ● It is hosted on Vercel in the public cloud. ● The following additional tools are used: ○ Google Cloud Platform (for generating and hosting the bulk data assets and collecting assets for certain API endpoints) ○ Hasura Cloud (for delivery of data to the Oak Curriculum API, via another API) ○ Mux (for hosting static videos) ○ Sanity CMS (for API documentation content) . How do we detect and mitigate security and privacy threats? All access to our sites and services passes through Cloudﬂare, which handles approximately 20% of all internet traffic. Cloudﬂare analyses the traffic to identify threats, attacks, and bad actors, and automatically prevents access when a problem is found. It does not access any personal information. How do we comply with data protection legislation? As set out in our Privacy Policy, we stay compliant with relevant legislation by: ● Implementing strong security measures: ○ W

FAQs

What is the purpose of this DPIA user guide?

It helps users carry out a Data Protection Impact Assessment for Oak’s platform to support legal compliance and confidence in the platform’s safety and security.

Which related documents should be read alongside the guide?

Readers should use the guide together with Oak’s Terms and Conditions and policies for Privacy and Cookies across the main site, Aila (AI experiments), and the Curriculum API, plus any other listed platform policy documents.

How does Oak mitigate security and privacy threats?

Access to the sites and services passes through Cloudflare, which analyzes traffic for threats and blocks access when a problem is detected, without accessing personal information.

Oct 21, 2026

Uploaded by Theodore