DPIA — Data Protection Impact Assessment

Summary for schools and care teams. Full template available on request.

Context

Neuranova processes data of minor students, including wellbeing data. This falls under elevated risk (GDPR art. 35) and requires a DPIA.

Identified risks

• Unintended access to student files due to incorrect role assignment
• Profiling based on wellbeing data
• Data breaches via account takeover

Mitigating measures

• Row-level security per organisation and per child link
• No automated decision-making with legal effect
• MFA mandatory for teacher/care roles, strong password rules
• Audit log for all access to student files
• Data minimisation: only first name, no national registry number

Residual risk

Acceptable provided the data processing agreement is followed. Periodic re-evaluation at least annually.

Questions or need a full copy? tine.e.victoria@protonmail.com