1. Name of the third party involved in the processing activity
CS Ninja, a homework and practice service for Computer Science and IT. CS Ninja acts as a data processor on the school's instructions.
Data protection
DPIA guide for schools
Last updated 14 September 2026
Most schools and trusts complete a Data Protection Impact Assessment (DPIA) before introducing a new system that processes pupil information. Many use a two-part form: Part A is a short screening assessment, and Part B is only needed if the screening shows the processing is likely to be high risk.
This guide sets out the usual screening questions with the information you need about CS Ninja, so you can complete your own form quickly. Your school remains the data controller and is responsible for the answers it gives, so please check each one against your own use of the service and share the completed form with your data protection officer.
If your DPO needs anything that is not covered here — a data processing agreement, our security details or a copy of our privacy notice — email privacy@csninja.co.uk and we will send it.
Part A — screening assessment
The details below relate to CS Ninja. Fill in your own school name, start date and whether the assessment is retrospective.
2. Describe the processing activity
What data is processed, why and how? What is the objective and intended outcome?
CS Ninja sets, marks and tracks Computer Science and IT homework. Teachers choose topics; the system generates questions, marks pupil answers automatically and reports progress.
Staff details processed: name, school email address, role and school. Pupil details processed: name, school email address, class membership and, where the school uploads a roster, a roster entry before the pupil first signs in. Learning records: homework and practice attempts, answers, marks, feedback, experience points, streaks and badges.
Data reaches CS Ninja either by staff adding pupils, uploading a roster file, or pupils signing in with their school Microsoft account. There is no direct link to the school MIS.
The objective is to reduce marking workload, give pupils immediate feedback and repeated practice, and give teachers reliable data on where classes are struggling.
3. Why is this the least intrusive method of achieving the purpose?
CS Ninja only needs the minimum needed to run homework: a pupil's name, school email address and class. No date of birth, UPN, address, attendance, SEN, ethnicity or other demographic data is required or requested.
Pupil details other than the email address used to sign in are held encrypted, so CS Ninja staff cannot read them. Schools can only see their own staff and pupils.
The alternative — marking homework by hand or through general-purpose spreadsheets and email — would involve more manual handling of pupil work and no access controls.
4. What personal data will be shared? Is a data sharing or processing agreement required?
Pupil: name, school email address, class membership, homework and practice answers, marks and progress.
Staff: name, school email address, role.
School: plan, billing frequency, licence status and payment references held by the payment provider.
Yes — a data processing agreement is required, because CS Ninja processes personal data on the school's behalf. CS Ninja's terms and conditions contain a standard data processing agreement. When registering, the school's administrator will need to agree to this. If you need a bespoke DPA, please request this from privacy@csninja.co.uk.
5. Does the processing involve special category data?
For example health, ethnicity, religion, biometrics or data revealing racial origin.
No. CS Ninja does not ask for or store SEN status, ethnicity, health data, free school meal or pupil premium eligibility, or any other special category data.
Schools should avoid entering such information in free-text fields, for example in a class name.
5a. Does the processing involve criminal offence data?
No.
6. Lawful basis
Schools normally process pupil data for CS Ninja under UK GDPR Article 6(1)(e) public task, as part of providing education, or Article 6(1)(f) legitimate interests where a school prefers that basis. Consent is not normally required.
For staff accounts and school billing, CS Ninja relies on the contract with the school and on its legitimate interests in running the service.
No special category condition is needed, because no special category data is processed.
7. Will the processing involve automated decision-making or profiling?
No decision with a legal or similarly significant effect is made automatically. Multiple-choice and short answers are marked automatically, and on the Ninja AI plan exam-style answers are given AI-generated marks and feedback.
These are formative marks to support teaching. Teachers see every result and can override it, and no grade, set placement or report is produced automatically.
8. Will the processing involve systematic monitoring of individuals?
No. CS Ninja records homework and practice activity only. There is no CCTV, location tracking, screen monitoring or monitoring of general online behaviour.
9. Will the processing involve large-scale processing? How many data subjects?
Schools typically enrol whole Computer Science and IT cohorts. Record the number of pupils and staff you intend to enrol (commonly 100–1000 in a single secondary school).
10. Will data be transferred outside the UK or EEA?
Pupil and school data is stored in the United Kingdom (London region).
On the Ninja AI plan, exam-style answers are sent to an AI marking provider for feedback, which may process them outside the UK under appropriate safeguards such as the UK International Data Transfer Addendum. Only the exam question, its mark scheme and the pupil's typed answer are sent; no name, email address, school, class or pupil identifier is included, so the request is not linked to an identifiable pupil. If a pupil types personal data into the answer itself, that text is sent as part of the answer. Answers are not used to train the provider's models. Schools that prefer no such transfer can use the Ninja Core or Ninja Plus plan, which do not use AI marking.
11. Does the processing involve innovative technology or novel use of data?
Only on the Ninja AI plan, which uses a large language model to mark exam-style answers against a mark scheme and give written feedback. Marking is always visible to, and can be changed by, the teacher.
The request to the model contains only the question, the mark scheme and the pupil's answer text — no personal data is attached. The only way personal data reaches the model is if a pupil types it into their answer, so remind pupils to keep personal details out of their answers.
Ninja Core and Ninja Plus use fixed question banks and rule-based marking with no AI.
12. Any other factors or risks for the DPO to consider?
Pupil details other than sign-in email addresses are encrypted at rest so that CS Ninja staff cannot read them.
Access is restricted to the pupil's own school; staff only see their own school's pupils and classes.
Sign-in is by school Microsoft account or by a username and password set by the school.
School accounts that are dormant for a long period are marked for deletion and then erased, with warning emails beforehand.
Annex — mitigations to record
These are the points a DPO usually wants evidenced alongside the screening form.
International transfers
Core service data is hosted in the UK. If you use AI marking, record the transfer and the safeguards relied on, and reference the data processing agreement.
You can record that the AI marking transfer contains only the question, mark scheme and the pupil's typed answer, with no identifying data attached, unless a pupil types personal data into their answer.
Special category data
Not applicable — CS Ninja does not process special category data.
Data minimisation and retention
Only enrol the pupils who need the service, and remove leavers at the end of the year. Learning records are deleted when the school asks or when the school's account is closed.
Security and access
Encrypted pupil details, school-scoped access, role-based permissions for staff, and sign-in through the school's Microsoft accounts where used.
Rights and transparency
Add CS Ninja to your pupil and staff privacy notices as a processor. Requests for access, correction or deletion come to the school, and CS Ninja will help you meet them.
Do you need Part B?
When a full DPIA is usually needed
Most schools find the CS Ninja screening does not show high risk, because no special category data is involved and there is no automated decision-making with significant effects.
If you use the Ninja AI plan, your DPO may ask you to complete Part B to record the AI marking and the related international transfer. We can supply the detail you need for those sections.
Ask us for anything missing at privacy@csninja.co.uk.