A DPIA template for AI assistants
A data protection impact assessment template for a school or trust connecting AI assistants to EstatesBase, with the answers EstatesBase can give and the questions only your organisation can answer.
Updated 17 October 2026
Use this template if your organisation decides it needs a data protection impact assessment (DPIA) before switching AI assistants on. Copy the headings into your own DPIA form. Under each heading, EstatesBase can say gives facts about how EstatesBase works. Your organisation answers lists what only you can decide. Your data protection officer should review the finished assessment.
This template is a starting point, not legal advice.
1. Why a DPIA is needed
Your organisation answers
- Why you are considering AI assistants, and for which staff.
- Whether you treat this as new technology, or as processing that could affect staff, pupils or others, that calls for a DPIA under your own procedures.
2. Describe the processing
EstatesBase can say
- What it is. A member of staff connects an AI assistant to their own EstatesBase account. The assistant can then look things up in EstatesBase for them, and, where your policy allows it and the person ticked it when connecting, ask for changes. A connection is read only unless the person ticks more.
- How a change is made. The assistant never changes anything on its own. It is shown a preview of the change in words. An everyday change or a change to a record is made only when the person says yes in the chat, unless your administrator makes it a proposal. A change to your organisation's settings, or a sensitive one (health and safety severity, RIDDOR, safeguarding, money, a statutory duty), is always a proposal: someone else approves it in EstatesBase, never the person who asked and never a trustee, and only someone who could make the change themselves. Some things never go through an assistant at all: Board and sign-off decisions, the Named Individual's declaration and attestation, access, deleting records, secrets, and DBS, barring and clearance records.
- Text an assistant writes. Where an assistant writes words into a record (a description, a note, a reason, a risk assessment's wording), the record shows a mark saying so, naming the assistant, the person who confirmed it and anyone who approved it. The mark appears on the record's page, its evidence record, and the evidence packs and PDFs that print it, and it cannot be removed. Structured changes (a status, a date, an assignment) are named in the record's History and the audit trail.
- Whose data. Mostly estate records: compliance, maintenance, assets, buildings, contractors, health and safety, governance and energy. Some records name staff (for example who owns a task). Health and safety records can describe incidents involving staff, pupils or visitors.
- How people are named. As your administrator chooses: first names only (the shipped choice), full names, initials only, or roles only.
- What is never shared. Email addresses, phone numbers, home addresses, file contents, confidential incidents, DBS, barring and clearance records, sensitive risk assessments (unless the person is on the list), witness statements, visit participants, passwords and secrets.
- Who receives the data. The provider of the assistant the person uses (for example Anthropic, OpenAI, Microsoft or Google) receives what the assistant reads, the previews it is shown and what the person types.
- Text written from outside your organisation. Every piece of stored text reaches an assistant marked as data, never instructions. Text written by someone outside your organisation (a guest's request through the public form or a QR code, a message through the public tracking link, an anonymous incident report, a credential a contractor added in their portal) is also marked as written from outside, with who wrote it.
- When. Only when a person's connected assistant asks. EstatesBase never sends data to an assistant on its own.
- What EstatesBase records. Each call: when, whose connection, which assistant, which tool, the outcome, a summary of what was asked with personal details removed, and how long it took. Each change: its preview, whether the person confirmed it, and for a proposal who approved or rejected it and why. A change made through an assistant names the assistant and any approver in the record's History and the audit trail.
Your organisation answers
- Which assistants you will allow, and which provider and service terms apply to each.
- How long each provider keeps conversations, and where.
- Which staff may connect.
3. Consultation
Your organisation answers
- Who you have consulted: your data protection officer, IT, senior leaders, trustees, staff representatives.
- Whether you will tell staff, and how. The acceptable use template can help.
4. Necessity and proportionality
EstatesBase can say
- Lawful basis and purpose are for your organisation. EstatesBase gives assistants only the records the person could already open.
- Data minimisation. Your administrator can limit who may connect, which assistants, which areas, how people are named and how long a connection lasts. Each person can narrow further: which areas, which sites, read only, and how long.
- Accuracy. Each tool reads the same figures as its page in EstatesBase, and each answer links back to that page so it can be checked.
- Transparency. Each person sees their own connections and their last calls on Connected apps. Administrators see every connection and every call, and approve proposals on Approvals. The Board pack carries the counts.
- Rights requests. The data stays in EstatesBase. Your usual processes for EstatesBase records still apply. Copies held by an assistant's provider are covered by your agreement with that provider.
Your organisation answers
- Your lawful basis, and whether you have checked it with your data protection officer.
- Why the benefit to estate management justifies sharing data with the provider.
5. Risks
Your organisation answers. Some risks to consider, with the controls EstatesBase offers:
| Risk | Controls in EstatesBase |
|---|---|
| An assistant sees more than it needs | Areas and sites limited by the policy and by the person; read only unless the person ticks more; trustees and department only staff limited further |
| Personal data reaches the provider | Names shown as your policy chooses; contact details, files and the most sensitive records never shared |
| An assistant is connected by someone else | Only the person themselves can connect, by signing in; View as cannot connect; optional administrator approval of each connection |
| An imitation assistant on a staff computer | A caution on the sign-in page for assistants that run on the person's own computer; administrators can see and end every connection |
| A wrong answer is relied on | Every answer links back to the page to check; the activity log records every call |
| A connection is forgotten | Every connection ends after the longest length you set (90 days unless you change it); suspending a person ends theirs |
| Your position changes and you want access cut | Switching the policy off ends every connection; after you tighten the policy, an administrator can end every connection at once |
| A change is made without the person agreeing | Every change is previewed first and made only when the person says yes, or proposed and approved in EstatesBase by someone else; you can require approval for every kind, or switch a kind off; settings and sensitive changes are always proposals |
| An assistant weakens a safeguard | Every change runs the same checks as the page, and some are stricter for an assistant: the statutory frequency floor, the barred task check and the site access clearance check refuse, with no override |
| Words the person did not write reach an inspector as evidence | Text an assistant writes is marked on the record, its evidence record and its packs, naming the assistant and the person who confirmed it; the mark cannot be removed |
| An instruction hidden in a record | Stored text reaches the assistant as data, never instructions; text written from outside your organisation is marked as such |
6. Measures to reduce risk
Your organisation answers
- Your policy settings, and why.
- Your agreements with each provider.
- Your staff guidance and training.
- How often an administrator will review the Connections and Activity tabs.
7. Sign off
Your organisation answers
- Who approved the DPIA and when.
- Your data protection officer's advice, and whether it was followed.
- When the DPIA will be reviewed, for example when a new assistant is allowed or when your policy allows a new kind of change.