What is a DPA?

A Data Processing Agreement (DPA) is a legally binding contract between Tawaasal (the data processor) and your school (the data controller). It governs how we handle personal data — particularly student and staff data — on your behalf.

Under UK GDPR and the Data Protection Act 2018, schools are required to have a DPA in place with any third-party service that processes personal data of students, staff, or parents.

Why Schools Need a DPA

• Legal Compliance: UK data protection law requires a written agreement between controllers and processors.
• Safeguarding: A DPA ensures student data is handled with the highest standards of care and security.
• Accountability: The DPA clearly defines responsibilities, data retention periods, breach notification procedures, and sub-processor management.
• Procurement: Many local authorities and multi-academy trusts require a signed DPA before approving new EdTech tools.

What Our DPA Covers

• Scope of data processing and categories of personal data
• Technical and organisational security measures (AES-256 encryption, MFA, tenant isolation)
• Sub-processor list and notification of changes
• Data breach notification within 72 hours
• Data subject rights assistance
• Data retention and deletion procedures
• International data transfer safeguards
• Audit rights

Download the DPA

You can download our standard DPA below. If your school requires a countersigned version or has specific amendments, please use the contact form on this page.

Request a Countersigned DPA

If your school or local authority requires a countersigned copy, fill out the form below and we will process your request within 5 working days.