Background
RedPenAI is a UK-based EdTech startup developing AI-powered tools to support primary school teachers. Their solution enables teachers to photograph students’ written work and receive tailored feedback aligned with national curriculum objectives, significantly reducing marking time.
Following successful Department for Education funding, RedPenAI entered the pilot phase and began offering its platform free of charge. As they worked to bring their product to schools nationwide, RedPenAI engaged The DPO Centre to ensure its handling of children’s personal data met legal and ethical standards from the outset.
Key Challenges
- Clarifying data controller relationships
- Understanding GDPR & DPA 2018 obligations
- Creating clear privacy communications
Solution
The DPO Centre worked closely with RedPenAI to assess the data protection implications of its AI tool, particularly when handling children’s data. This included advising on how the model processes information, identifying a lawful basis, and ensuring appropriate transparency and accountability.
To clarify roles and responsibilities, the designated DPO confirmed RedPenAI’s position as a data processor and advised on the need for school authorisation before teacher use. A tailored Data Processing Agreement (DPA) was added to the platform’s Terms and Conditions, and a processor-friendly Data Protection Impact Assessment (DPIA) template was created to help schools understand and document the tool’s use.
To support clear communication, the DPO developed a full suite of privacy documentation, including a privacy notice, cookie notice, FAQs, and a factsheet for parents explaining how the tool works and how data is protected.
With national rollout on the horizon, the DPO also began early discussions around the EU AI Act and UK legislative developments, helping RedPenAI prepare for regulatory change.
Outcome
Jamie Fones, CEO at RedPenAI said: ‘Working with The DPO Centre gave us the confidence to move quickly without compromising on data protection. Their guidance helped us clearly define our role as a processor, put the right safeguards in place, and communicate transparently with schools and parents from day one.’
