Support for the school's data protection impact assessment (DPIA)
Version 1.0 · Effective from 4 October 2026 · Last updated 4 October 2026
Viafocus AB, company reg. no. 559547-4882
This document exists in Swedish and English. If they differ, the Swedish version prevails. Svensk version: /sv/dpia.
In short
This is our support material. The assessment is the education provider's to make.
- Does the school need an impact assessment?
- Plan for one. IMY itself names large-scale processing of children's personal data in schools.
- Who carries it out?
- The education provider (huvudman), as controller. Viafocus AB is the processor and supplies the facts: this document and Annex 1 to the data processing agreement.
- What can the school switch off?
- Screenshots, the list of tabs and apps, and the active tab and app, for the whole school. The school can also switch on sleep outside school hours and limit Focuspilot to the school network.
- Are screenshots stored?
- No. They are shown only while a teacher has the pupil in view, and they are never stored.
1. Is an impact assessment needed?
An impact assessment is required when processing is likely to result in a high risk to the people concerned (GDPR Article 35). IMY's list requires one when at least two of nine criteria apply. Focuspilot can meet three:
Criterion 3 in IMY's list: if the school has Active tab and app or Screenshots switched on, the teacher sees what pupils have on their screens.
Criterion 5, large scale: every pupil in the classes that use the service.
Criterion 7, vulnerable data subjects: children, who depend on the school.
So complete an impact assessment before you start. For a small pilot the education provider decides how extensive it needs to be.
2. Who does what
| Question | Viafocus | The education provider |
|---|---|---|
| Which data is processed | Describes it, here and in Annex 1 | Checks that the description matches how the school uses the service |
| Purpose and legal basis | Proposes, sections 3 and 5 | Decides |
| Necessity and proportionality | Shows the less intrusive choices, section 6 | Assesses for its own schools and chooses |
| Which features are on | Provides the switches | Switches them on or off |
| Information to pupils and guardians | Provides a text to start from, section 9 | Informs |
| Consultation | Answers questions | Consults the data protection officer, safety representative and unions. If high risk remains: prior consultation with IMY. |
| Security at the processor | Responsible, see /en/security and /en/subprocessors | Reviews |
3. Purpose
Focuspilot has one purpose: to let the teacher keep pupils' school computers on the lesson's work during class. This supports the school's duty to give pupils a safe environment with a calm place to study (Swedish Education Act, chapter 5, section 3). Every processing in section 4 serves one of these tasks:
Steer: the teacher sets a mode for the class or a pupil. Explore (free), Focus (distractions stopped) or Lock (only what the teacher chose is open).
See that steering works: whether the device is connected and which mode it has.
Help a pupil back to the task: if the school has chosen it, which page or app the pupil has open and an image of the screen.
Protect: pages that do not belong on a school computer are blocked.
Run tests: exam mode locks the device during a digital test.
Focuspilot is not used for grading, for judging a pupil's attention or ability, for disciplinary cases or for profiling. Write this into your assessment as a limit on the purpose.
4. Data point by data point
The table shows what the pupil's school computer sends and how long it is kept. Accounts, classes and teachers are in Annex 1 to the data processing agreement.
| Data | Why | When it is sent | How long | Less intrusive choice |
|---|---|---|---|---|
| Connected, active or idle | The teacher must know whether steering reaches the device | While the pupil is signed in and the device is connected | Latest value only, at most 24 hours | Sleep outside school hours |
| Active tab on Chromebook: address and title, number of tabs and windows, whether audio plays, titles of the active tab in other windows and of tabs playing audio | So the teacher can see whether the pupil is on task | The whole time the device is connected. Shown only to the class's teachers, while the class view is open. | Only the latest, so the teacher's view fills in at once. Replaced by each new report and deleted when the computer disconnects. Never saved to a database. | The Active tab and app switch: then neither address nor title is kept or shown. Sleep outside school hours and School network limit when. |
| Active app on Windows: app name, window title, web address, idle time | As above | As above | As above | As above |
| Blocked attempts (site) | So the teacher sees when the filter stops something | When a page is blocked | As the active tab. No history of addresses. | The Active tab and app switch hides the address. The block still applies. |
| List of open tabs and apps | So the teacher can close a tab or app for the pupil | Shown only while the teacher has the pupil open in their view | Not stored | The Tabs and apps switch |
| Screenshot: the tab on Chromebook, the screen on Windows | So the teacher sees what the pupil is working on | Only while a teacher has the pupil in view, as a thumbnail or full size | Never stored | The Screenshots switch |
| Device details: platform, app version and when the device was last connected | Troubleshooting and making sure the right version runs | On connection | 7 days | None |
| IP address | The school network check, if the school has switched it on | On connection | Used for the check | None |
| Teacher commands: which teacher set which mode for which class or group, and when | So the school can see what applied | On every command | 90 days | None. This is the steering itself. |
| Exam events: the kind of event, for example a paste or the pupil leaving the exam window. No content. | So the test runs fairly | During a test | At most 24 hours | Do not use exam mode |
| Activity history per pupil: mode changes and when the pupil connected. Never websites, domains or app and window names. | Follow-up for the school | Only if the school switches on activity history (off at the start) | The school chooses 7 to 365 days, 90 by default | Leave it off |
Never collected: keystrokes, passwords, cookies, camera, microphone and audio recording. We never save which websites or apps a pupil used. Under Lock the Windows app stops some keyboard shortcuts; what the pupil types is never read.
5. Legal basis
For Swedish schools, municipal and independent alike, a task carried out in the public interest (Article 6(1)(e)) is the basis IMY says can most often be used. The task is education under the Education Act, and the basis holds as far as the processing is necessary for it. Consent does not work, because the pupil depends on the school.
6. Necessity and proportionality
The features are built as a ladder. The school chooses the lowest step that is enough.
| Step | What the teacher sees and does | How the school chooses it |
|---|---|---|
| 1. Filter and modes only | The teacher sets Focus or Lock and sees whether the device is connected and which mode it has. | Switch off Active tab and app, Tabs and apps, and Screenshots. |
| 2. Active tab or app | As step 1, plus the address and title of what the pupil has open, and blocked attempts, while the teacher has the class view open. | Switch off Screenshots and Tabs and apps. |
| 3. Tabs and apps | As step 2, plus the list of the pupil's open tabs and apps, and closing them. | Switch off Screenshots. |
| 4. Screenshots | As step 3, plus images of the pupil's screen while the teacher has the pupil in view. | All three switches on. This is how it starts. |
Two choices apply at every step and limit when Focuspilot is active: Sleep outside school hours (devices disconnect outside the school hours the school has set) and School network (during school hours the teacher sees pages, tabs and screenshots only for pupils connected from the school's network). The school switches on sleep outside school hours once its school hours are set.
7. Safeguards in the service
Only the class's teachers see the class in Focuspilot, and only while the class view is open. School admins see the school's classes and groups in the admin pages, but not in Focuspilot.
Screenshots are never stored, and we never save which websites or apps a pupil used. Activity history is off at the start.
The pupil always sees when the teacher is looking at the screen: a green dot on the Focuspilot icon in Chrome, and a message and a tray icon on Windows.
The switches apply in the service, not only in the teacher's view.
Switching Active tab and app, Tabs and apps or Screenshots back on requires the admin to confirm that an impact assessment has been made and that the safety representative and unions have been informed. The change is logged.
No AI assesses the pupil. The teacher's AI assistant can read the same lesson data the teacher sees, but not exam events. It runs on Microsoft Azure inside the EU and can be switched off for the whole school. A school can use its own AI key; the questions then go to the provider the school itself has an agreement with.
8. Risks to pupils and how they are reduced
| Risk | What the service does | What the school does |
|---|---|---|
| The pupil feels watched and does not search freely, even when allowed | A visible sign when the teacher is looking at the screen. No conclusions are drawn about the pupil. | Explains when and why Focuspilot is used. Uses Explore when the lesson allows free searching. |
| The teacher sees something private in a screenshot | Images only while the teacher has the pupil in view. Nothing stored. | Switches screenshots off if the need is not clear. Instructs teachers not to record or share what they see. |
| Data about the pupil's free time, on a school computer at home | Shows live data only when the class's teacher has the class view open. Keeps only the latest and deletes it when the computer disconnects. | Switches on sleep outside school hours once school hours are set; then nothing is sent. Can switch off Active tab and app. |
| The feature is used for something other than teaching | Viafocus processes only on the school's instructions (the data processing agreement) | Writes the limit into its routines and follows it up |
| Wrong blocking gets in the way of teaching | The school and the teacher control categories and allowed pages. | Has a way to deal quickly with a wrongly blocked page |
| Unauthorised access or a data leak | Role control, separation between schools and encryption, see /en/security | Requires sign-in through the school's accounts and removes staff who leave |
| Data is kept longer than needed | Short retention, no history at the start, deletion when an account or school is removed | Chooses the shortest possible history, or none |
9. Information to pupils and guardians
Pupils have the right to know what is processed (Article 13). The information should suit their age. A text to start from, which the school adapts to its choices:
"We use Focuspilot on the school computers. The teacher can lock the computer to what the lesson is about. [If active tab and app is on:] Your teacher can see which page or app you have open, but only while the teacher has the class open. It is not saved. [If screenshots are on:] The teacher can also see images of your screen. You will see this on the computer. The images are not saved. What you type is never read. [If sleep is on:] Outside school hours Focuspilot is asleep. Questions: [school contact]."
Annex A. Template for the education provider's impact assessment
The headings follow Article 35(7) and IMY's guidance. Copy them into your own document and fill them in.
A1. Description: which schools, year groups and teachers; which steps and choices you have made (sections 4 and 6); systems and sub-processors (Annex 1 and /en/subprocessors).
A2. Purpose: the problem you want to solve, with examples from your schools, and what Focuspilot must not be used for.
A3. Legal basis: public task, with reference to the Education Act and your own reasoning.
A4. Necessity: what less intrusive approach you have tried or considered, and why it was not enough.
A5. Proportionality: chosen step, which pupils, which hours, chosen retention, and how you inform.
A6. Risks to pupils' rights and freedoms: likelihood and severity of each risk (section 8).
A7. Measures: technical (switches, Sleep, retention) and organisational (routines, teacher training, information text).
A8. Views: the data protection officer's opinion, the safety representative and unions, and where possible pupils and guardians.
A9. Conclusion: does high risk remain? If so, prior consultation with IMY before starting.
A10. Review: when the assessment is revisited, for example after a term or when a feature is switched on.
Sources. IMY's list of when an impact assessment is required: https://www.imy.se/globalassets/dokument/ovrigt/forteckning---konsekvensbedomningar.pdf
IMY on digital teaching and legal basis: https://www.imy.se/verksamhet/dataskydd/dataskydd-pa-olika-omraden/skola-och-forskola/digital-undervisning/
Questions about this material, and requests for Annex 1: dataskydd@viafocus.net.
Change history
First version.