Data Protection Impact Assessment (DPIA)
Veritas Oracy Assessment Platform — Compliance with UK GDPR and Child Safety Standards.
1. Necessity & Purpose
SayVeritas is an AI-powered oracy assessment platform that records students' verbal responses to assess reasoning and evidence.
Aims:
- Automate teacher marking for oral assessments.
- Provide real-time safeguarding through mental health "crisis detection."
- Improve student outcomes through Socratic AI feedback.
DPIA Need: Mandatory under UK GDPR due to processing children's data at scale and using novel AI technologies for automated decision-making and safeguarding. Processing is designed in line with the ICO Children's Code principles, prioritising data minimisation, transparency, and the best interests of the child.
2. Nature of Processing
Data Collection
Students record audio via the web browser. Audio is temporarily buffered as base64 and then uploaded to secure Supabase Storage.
AI Pipeline
Audio is sent to OpenAI Whisper or Gemini for transcription. Transcripts are processed by Gemini-1.5-Flash for scoring and crisis detection.
No Biometric ID
Audio recordings are not used for biometric identification or authentication. No voiceprints or speaker profiles are generated.
Retention
Audio is retained for a maximum of 30–90 days, and may be deleted sooner following teacher review or safeguarding triage.
3. Lawful Basis
Maintenance/State Schools
Public Task (Article 6(1)(e)) where deployed by maintained schools, academies, or local authorities.
Independent Schools
Legitimate Interests (Article 6(1)(f)) where deployed by independent schools, with a Legitimate Interests Assessment (LIA) completed.
Safeguarding (Special Category)
- Article 9(2)(g): Substantial Public Interest.
- DPA 2018 Schedule 1, Part 2, paragraph 18: Safeguarding of children.
Human-In-The-Loop Guarantee
The system does not make solely automated decisions with legal or similarly significant effects (Article 22). All assessment outcomes and safeguarding alerts are subject to human review by teachers or designated safeguarding staff.
Crisis detection operates as a support signal only and does not replace school safeguarding procedures, professional judgment, or statutory reporting obligations.
4. Risk Assessment & Mitigation
| Risk | Mitigation | Residual Risk |
|---|---|---|
| AI Bias / Accuracy | Teacher overrides for every AI score; confidence markers. | Low |
| Safeguarding failure | Multi-keyword matching + immediate teacher email alerts. | Low |
| Unauthorized Access | Supabase RLS + logical tenant isolation. | Low |