Document Information
| Version | 1.1 |
| Status | Approved by DPL |
| Date prepared | 28/5/2026 |
| Most recent amendment | 2/6/2026 |
| Prepared by | Gabriel Gendler Yom-Tov (Director of Mathematical Programmes, MCP) |
| Reviewed by | Syreeta Allen (Axiom Maths) |
Project Details
| Name of controller | Axiom Maths (operating the Maths Coaching Pilot) |
| Name of project / system | Airtable – MCP Pupil Database |
| Description | Airtable is used as the central database for managing pupils, coaches, sessions, assessment results, and family contacts across the Maths Coaching Pilot programme. |
| Legal basis for processing | Article 6(1)(f) — legitimate interests; Article 9(2)(g) — substantial public interest (Schedule 1 Part 2, paragraphs 8 and 18, DPA 2018); Article 9(2)(a) — explicit consent (supplementary safeguard, ethnicity data only) |
Step 1: Identify the Need for a DPIA
Explain broadly what the project aims to achieve and what type of processing it involves. Summarise why you identified the need for a DPIA.
Process description: The Maths Coaching Pilot (MCP) is a long-term mathematics education intervention for exceptionally talented but disadvantaged pupils in England, incubated at Axiom Maths. Airtable is used as MCP’s primary operational database to record information about pupils, coaches, coaching sessions, family contacts, assessment results, and programme events. Data will be entered manually by programme staff and coaches and retained until the end of the academic year in which the individual turns 25 years of age.
The need for a DPIA was identified because:
- The database holds personal data about children, including special category data (SEND and ethnicity)
- Personal data is transferred to servers in the USA, which is not covered by a UK adequacy decision (see Annex B for mitigation; UK and EU SCCs are included in a DPA signed with Airtable)
- The programme involves long-term observations of children over a period of up to 16 years
Two or more of the ICO’s criteria for mandatory DPIAs are met.
Step 2: Describe the Processing
Describe the nature of the processing: how will you collect, use, store and delete data? What is the source of the data? Will you be sharing data with anyone? What types of processing identified as likely high risk are involved?
How will you collect, use, store and delete data? Data is entered manually into Airtable by programme staff and coaches. It is used to manage pupil enrolment and programme participation, assign coaches, record sessions, track assessment results, and maintain family contact. Data is retained until the end of the academic year in which the individual turns 25 years of age, and deleted from Airtable by the designated data owner at that point.
What is the source of the data? Pupils and families (at enrolment and on an ongoing basis); partner schools (school name, address, key contact); coaches (session notes, interaction logs); external course providers (e.g. Art of Problem Solving).
Will you be sharing data with anyone? Data is shared internally only. Airtable processes data as a sub-processor. Airtable may share data with its own sub-processors; these are listed at airtable.com/company/subprocessors.
What types of processing identified as likely high risk are involved? Children’s personal data including special category data (SEND); disadvantage indicators (looked-after status, Free School Meals, Pupil Premium); free-text professional notes about individual children; long-term retention of up to 16 years (for more information on our justification for retention, see Annex A of our privacy notice); international transfer to the United States.
Describe the scope of the processing: what is the nature of the data, and does it include special category or criminal offence data? How much data will you be collecting and using? How often? How long will you keep it? How many individuals are affected? What geographical area does it cover?
What is the nature of the data, and does it include special category or criminal offence data? Yes. The database includes special category data: SEND status and detail (health/disability, Article 9 UK GDPR). The full data held is as follows:
| Table | Fields | Special category? |
|---|---|---|
| PUPIL | Name, date of birth, programme status, entry year, cohort | No |
| PUPIL | Postcode deprivation score, Pupil Premium eligibility, FSM eligibility, looked-after status | No |
| PUPIL | SEND status and detail | Yes – health/disability (Article 9 UK GDPR) |
| PUPIL | Ethnicity (optional, evaluation only) | Yes – racial/ethnic origin (Article 9 UK GDPR); explicit consent obtained separately at enrolment |
| PUPIL | Sex | No |
| SCHOOL | School profile data (name, address, URN, type, phase, age range) | No |
| SCHOOL | Key contact name and contact details | No |
| SCHOOL_HISTORY | Pupil-school links with dates | No |
| COACH | Name, contact details, specialism notes | No |
| COACH_ASSIGNMENT | Coach-pupil assignments with dates | No |
| SESSION | Session date, topics covered, coach notes | No |
| FAMILY_CONTACT | Parent/carer name, relationship, contact details, preferred contact method, language | No |
| INTERACTION_LOG | Date, contact type, free-text notes | No. Notes may contain references to special category data, but only data already recorded above. |
| ASSESSMENT_RESULT | Assessment name, provider, date, score, grade/percentile, notes | No |
| PUPIL_COURSE_OCCURRENCE | Score, outcome notes | No |
| PUPIL_EVENT | Attendance, notes | No |
How much data will you be collecting and using? The founding cohort is approximately 100 pupils. At steady state the programme recruits up to 180 new pupils per year, with several hundred active pupils at any one time, plus historical records of alumni. Coach and family contact data adds further data subjects.
How often? Data is collected at enrolment and updated on an ongoing basis. Session records are created weekly. Assessment results are updated between twice and seven times per year.
How long will you keep it? Data for candidates is retained for a minimal length of time after the pupil selection process concludes, and not longer than sixty days. School contact records (the name and contact details of our key contact at each school) are deleted when the relevant pupil leaves the school or completes the programme. School profile data is retained as part of the pupil’s long-term record. Data for a parent or carer is retained only as long as they are a nominated contact for the programme, and deleted when the pupil leaves or completes the programme.
Pupil data is retained until the end of the academic year in which the individual turns 25 years of age. For pupils entering at Year 5 (age 9), this is a retention period of up to 16 years. Retention beyond active programme participation is justified by programme evaluation purposes. Our privacy notice lays out the justification and lawful basis for retaining this data, based on Legitimate Interests (Article 6(1)(f)).
How many individuals are affected? Pupils (100 children aged 8-13); family contacts (one or more per pupil); coaches (up to six); school contacts (one or more per partner school).
What geographical area does it cover? UK only (data subjects). Data is stored on Airtable’s US infrastructure.
Describe the context of the processing: what is the nature of your relationship with the individuals? How much control will they have? Would they expect you to use their data in this way? Do they include children or other vulnerable groups? Are there prior concerns over this type of processing or security flaws? Is it novel in any way?
What is the nature of your relationship with the individuals? Voluntary programme participation relationship with pupils and families, governed by programme enrolment terms. Contractual employment relationship with coaches. Professional partnership with school contacts.
How much control will they have? Families may request access to, correction of, or deletion of their child’s data at any time. All standard data subject rights under UK GDPR apply and will be supported. Withdrawal from the programme results in cessation of active data collection, subject to the retention schedule. Coaches may access and correct their own data.
Would they expect you to use their data in this way? Yes. Data is collected and used directly to deliver the programme. A privacy notice will be provided to all data subjects before data collection begins.
Do they include children or other vulnerable groups? Yes. All pupil data relates to children (ages 9-18).
Are there prior concerns over this type of processing or security flaws? None known. Airtable holds SOC 2 Type II, ISO 27001, and ISO 27701 certifications. Security documentation is available at airtable.com/security.
Is it novel in any way? No. Airtable is an established platform. The specific combination of long-term observation of children with SEND and disadvantage data is not unprecedented in education programme management.
Are you signed up to any approved code of conduct or certification scheme? No.
Describe the purposes of the processing: what do you want to achieve? What is the intended effect on individuals? What are the benefits of the processing?
What do you want to achieve? Airtable provides the structured database required to manage programme delivery – tracking pupils, coaching sessions, assessment outcomes, family contact, and alumni progression over a multi-year programme.
What is the intended effect on individuals? Equitable access to and participation in the programme; effective delivery of a high-quality education intervention; appropriate safeguarding and welfare support; long-term observation of alumni to support progression to and through higher education.
What are the benefits of the processing – for you, and more broadly? Effective data management enabling programme delivery and evaluation; evidence of impact to secure continued funding; improved outcomes for disadvantaged children in mathematics education.
Step 3: Consultation Process
Consider how to consult with relevant stakeholders.
| Who will be consulted? | When? | How? | Responses |
|---|---|---|---|
| Airtable Inc (provider) | Prior to DPA signature; further correspondence in May ‘26 | Airtable DPA process; email | DPA signed 5/5/2026; custom DPA signed 1/6/2026 |
| DPL (Syreeta Allen, Axiom Maths) | During DPIA completion | Collaboration on Notion page | DPL review completed 28/5/2026 |
| Programme staff / coaches | Prior to data collection | Briefing and written guidance | To be documented |
Data subjects (pupils and families) will be provided with a link to the privacy notice at the time of application, including information about data processing through Airtable. It is reasonable for individuals to expect their data to be used in this way in order to deliver the programme.
Security measures: Airtable
Airtable employs the following security measures:
- Encryption at rest and in transit
- Role-based access control (RBAC), enabling field- and table-level permissions
- Multi-factor authentication (MFA) support
- SOC 2 Type II, ISO 27001, and ISO 27701 certification
- Single sign-on (SSO) support
- Audit logs for workspace activity
MCP will configure Airtable to enforce MFA on all accounts and restrict access to sensitive fields to those with a documented business need.
Step 4: Assess Necessity and Proportionality
Describe compliance and proportionality measures.
What is your lawful basis for processing?
| Purpose | Article 6 basis | Article 9 basis | Notes |
|---|---|---|---|
| Programme operation (including SEND data) | 6(1)(f) — legitimate interests | Article 9(2)(g) — substantial public interest (Sch 1 Pt 2, para 18 DPA 2018: safeguarding of children and of individuals at risk; para 8 DPA 2018: equality of opportunity or treatment) | APD prepared and signed off by DPL (18/5/2026) |
| Programme evaluation (including SEND data) | 6(1)(f) — legitimate interests | Article 9(2)(g) — substantial public interest (Sch 1 Pt 2, para 8 DPA 2018: equality of opportunity or treatment) | APD prepared and signed off by DPL (18/5/2026) |
| Ethnicity data (evaluation only) | Article 6(1)(f) — legitimate interests | Article 9(2)(g) — substantial public interest (Sch 1 Pt 2, para 8 DPA 2018: equality of opportunity or treatment); Article 9(2)(a) — explicit consent (supplementary safeguard) | Optional and self-reported; used solely for programme evaluation and demographic monitoring; explicit consent obtained additionally at enrolment; not used operationally; APD signed off by DPL (18/5/2026) |
| Sex (programme operation) | 6(1)(f) — legitimate interests | N/A – not special category | Used operationally (e.g. event nominations, residential arrangements, personalised communications) |
| Family contact communications | 6(1)(f) — legitimate interests | N/A – not special category | |
| Coach employment data | Article 6(1)(b) – employment contract | N/A – not special category | Standard employment data |
Special category data is processed under Article 9(2)(g) UK GDPR (substantial public interest), supported by Schedule 1 Part 2 of the Data Protection Act 2018. The specific Schedule 1 conditions relied upon are: paragraph 18 (safeguarding of children and of individuals at risk) for the processing of SEND data in connection with programme delivery; and paragraph 8 (equality of opportunity or treatment) for the processing of both SEND data and ethnicity data for programme evaluation and demographic monitoring. Explicit consent under Article 9(2)(a) is additionally obtained at enrolment for ethnicity data as a supplementary safeguard, in recognition of its particular sensitivity.
The conditions for processing and the procedures for compliance with the data protection principles are set out in the Maths Coaching Pilot Appropriate Policy Document (APD), signed off by the DPL on 18/5/2026 and available to the Information Commissioner’s Office on request.
Does the processing achieve your purpose? Yes.
Is there another way to achieve the same outcome? Alternative tools exist but Airtable was chosen for its flexibility and cost-effectiveness for a small programme.
How will you prevent function creep? Data will be used only for the purposes set out in this DPIA. New use cases will be assessed against this DPIA before implementation.
How will you ensure data quality and data minimisation? Only the fields described in Step 2 will be populated. No additional data will be collected without a documented purpose. Free-text fields (e.g. coach session notes and interaction log notes) will carry written guidance for staff to record only what is necessary and relevant.
What information will you give individuals? A privacy notice will be provided to all data subjects before data collection begins, setting out purposes, legal bases, retention periods, and rights.
How will you support data subject rights? MCP will designate a responsible person for data subject access requests (DSARs) and other rights requests. Airtable’s search and export functionality will be used to fulfil DSARs.
What measures do you take to ensure processors comply? Airtable DPA signed 5/5/2026 (DocuSign: 2FA30E0F-498D-89DE-817F-5287C082BFDD), covering Article 28 UK GDPR requirements including sub-processor obligations, security measures, breach notification (72 hours), data subject request assistance, DPIA assistance, and data deletion on termination. Updated custom DPA signed 1/6/2026 (DocuSign: 434D45CA-D446-8BF3-83FD-515D65374C8F).
How do you safeguard any international transfers? Airtable DPA incorporates UK SCCs (ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses) at Section 9.3, providing the Article 46 UK GDPR safeguard for UK-to-US transfers. A full Transfer Risk Assessment (TRA) has been prepared and signed off by the DPL (21/5/2026), assessing the risk to data subjects arising from the UK-to-US transfer. The TRA is a standalone document retained alongside this DPIA and available to the Information Commissioner’s Office on request. See also Annex B.
Step 5: Identify and Assess Risk; Step 6: Identify Measures to Reduce Risk
| Step 5: Source of risk and nature of potential impact on individuals | Likelihood of harm | Severity of harm | Overall risk | Step 6: Options to reduce or eliminate risk | Effect on risk | Residual risk | Measure approved |
|---|---|---|---|---|---|---|---|
| Unauthorised access to Airtable workspace via compromised credentials, exposing children’s personal data including SEND information | Low-Medium | Severe | High | Enforce MFA on all Airtable accounts; implement minimum necessary access (RBAC); review permissions regularly; design process of account deletion when staff members leave | Treat | Low | 28/5/2026 |
| Data breach on Airtable’s infrastructure, resulting in disclosure of children’s personal data | Low | Severe | Medium | Verify SOC 2 Type II certification; review Airtable security documentation annually | Tolerate (residual) | Low | 28/5/2026 |
| SEND data and disadvantage indicators accessible without sufficient access controls | Medium | Moderate | Medium | Configure RBAC to restrict SEND fields and disadvantage indicators (e.g. pupil SEND status, looked-after status, FSM eligibility) to DPL and designated programme leads only; document access matrix | Treat | Low | 28/5/2026 |
| Free-text fields (e.g. coach session notes and interaction log notes) accessible without sufficient access controls | Medium | Moderate | Medium | Restrict access to free-text records (e.g. coach session notes and interaction log notes) to the relevant coach and programme leads only; provide written data minimisation guidance to staff | Treat | Low | 28/5/2026 |
With the above measures in place, all residual risks are assessed as Low. Processing may proceed subject to completion of the actions below.
Step 7: Sign Off and Record Outcome
| Item | Name / position / date | Notes |
|---|---|---|
| Measures approved by | Gabriel Gendler Yom-Tov Director of Mathematical Programmes, MCP 27/5/2026 | Integrate actions into project plan with dates and owners [complete] |
| Residual risks approved by | Syreeta Allen DPL, Axiom Maths 28/5/2026 | If accepting any residual high risk, consult ICO before proceeding [N/A] |
| International transfer mechanism confirmed | Airtable DPA signed 5/5/2026; UK SCCs included at Section 9.3; Transfer Risk Assessment signed off by DPL 21/5/2026; updated custom DPA signed 1/6/2026 | Completed |
| This DPIA will be kept under review by | Gabriel Gendler Yom-Tov (MCP), supported by DPL | Review annually or when processing changes materially |
I confirm that I have reviewed this DPIA and am satisfied that:
- In relation to the processing of personal data, at least one of the lawful grounds in Article 6 of the UK GDPR applies;
- In relation to the processing of special category data, at least one of the conditions in Article 9 of the UK GDPR also applies; the condition relied upon is Article 9(2)(g) (substantial public interest), supported by Schedule 1 Part 2 paragraphs 8 and 18 of the DPA 2018, as set out in the Appropriate Policy Document signed off by the DPL on 18/5/2026;
- A Transfer Risk Assessment has been prepared and signed off by the DPL (21/5/2026), confirming that the UK-to-US transfer to Airtable may proceed under the UK SCCs;
- All relevant privacy risks and solutions have been identified and, where possible, mitigated;
- The solutions identified represent a targeted and proportionate response to the identified privacy risks.
| DPIA completed by | Gabriel Gendler Yom-Tov |
| Job title | Director of Mathematical Programmes, Maths Coaching Pilot (Axiom Maths) |
| Date | 27/5/2026 |
Monitoring update: ICO children’s data guidance (July 2026)
DUAA 2025 introduced a “recognised legitimate interest” basis (in force since 5 February 2026, ICO guidance 23 March 2026) with a “safeguarding of vulnerable individuals” condition that, unlike the standard Article 6(1)(f) basis currently relied on in this DPIA, removes the need for a balancing test. MCP will consider adopting this basis at the scheduled May 2027 review.
Annex A: DPIA Screening Questions
| Question | Yes/No | DPIA required? |
|---|---|---|
| Is there processing of personal data? | Yes | If no, DPIA not necessary. |
| Systematic and extensive profiling or automated decision-making with significant effects? | No | If yes, DPIA mandatory. |
| Processing special category data on a large scale? | No | If yes, DPIA mandatory. |
| Systematically monitoring a publicly accessible place on a large scale? | No | |
| Use of new or novel technologies? | No | |
| Profiling or special category data used to decide access to a service, opportunity or benefit? | No | |
| Large-scale profiling? | No | |
| Processing biometric or genetic data? | No | |
| Combining or matching data from multiple sources? | Yes | Where two or more criteria are met, DPIA recommended. |
| Processing without providing a privacy notice directly to the individual? | No | |
| Tracking individuals’ location or behaviour? | No | |
| Children’s personal data for profiling, automated decision-making, or marketing? | No | |
| Risk of physical harm in event of a security breach? | Yes (looked-after children) |
| Further questions | Yes/No | Notes |
|---|---|---|
| Evaluation or scoring with significant automated effects? | No | Assessment results recorded but not used for automated decisions |
| Processing sensitive data of a highly personal nature? | Yes | SEND, looked-after status, FSM, Pupil Premium, coach notes |
| Processing on a large scale? | No | Growing to several hundred pupils at steady state |
| Major project involving use of personal data? | Yes | New programme; new database |
Conclusion: A DPIA is required. Two or more mandatory criteria are met (special category data; children’s personal data; combining data from multiple sources).
| Screening questions completed by | Gabriel Gendler Yom-Tov |
| Date | 5/5/2026 |
Annex B: International Transfer – Summary Note
A full Transfer Risk Assessment (TRA) has been prepared as a standalone document and signed off by the DPL (21/5/2026). The TRA sets out the full assessment of the UK-to-US transfer to Airtable in accordance with Articles 44-49 UK GDPR and the ICO’s guidance, including reliance on the DSIT analysis of the UK Extension to the EU-US Data Privacy Framework, and the specific safeguards in place. The summary below is provided for completeness; the TRA is the primary record for international transfer compliance.
| Processor | Formagrid Inc dba Airtable, 1 Front Street, Fl 28, San Francisco, CA 94111, USA |
| Transfer | Personal data (including children’s data and special category data) stored and processed on Airtable’s US infrastructure |
| Applicable law | UK GDPR Articles 44-49 |
| Transfer mechanism | UK SCCs (ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses), incorporated at Section 9.3 of the Airtable DPA signed 5/5/2026 |
| Adequacy / DPF | Not applicable. Formagrid Inc (dba Airtable) was checked against the Data Privacy Framework participant list on 13 May 2026 and is not listed. The UK-US Data Bridge is therefore not available as a transfer mechanism. |
| Status | Closed — resolved. Airtable DPA signed 5/5/2026 (DocuSign: 2FA30E0F-498D-89DE-817F-5287C082BFDD); updated custom DPA signed 1/6/2026 (DocuSign: 434D45CA-D446-8BF3-83FD-515D65374C8F). TRA signed off by DPL 21/5/2026. |