New-purpose legitimate interests compatibility assessment

Enter the name of the maintained or academy school conducting this assessment.

Enter the name and role of the person responsible for completing this assessment.

Enter the date on which this assessment is completed.

Enter the planned start date. The processing should not proceed before this assessment and any required approvals are complete.

Describe what the school proposes to do with the personal information, including the systems, recipients, locations, and frequency involved.

State the specific purpose communicated or understood when the information was collected.

State the specific further purpose for which the personal information would be used.

Explain why the new purpose is connected to, expected from, or otherwise related to the original purpose. Identify any material differences.

List the data elements or categories involved. Identify any special category or criminal offence information if applicable.

Select all groups whose personal information may be used or who may be affected by the processing.

Describe what the people affected would reasonably expect the school to do with their information in the circumstances.

Consider privacy intrusion, loss of control, distress, discrimination, disadvantage, unexpected decisions, security risks, and effects on children or other vulnerable people.

Address the link between the purposes, the context of collection, the nature of the information, the relationship with the individuals, their reasonable expectations, and the possible consequences.

Explain why the purpose cannot reasonably be achieved without this processing, and identify less intrusive alternatives considered.

Select the applicable answer and explain the basis for it in the next field.

If a new assessment is required, record the legitimate interest, the necessity assessment, the balancing assessment, and the conclusion. If one is not required, explain the reasoning and identify any advice relied on.

Describe any updates needed to privacy information, notices, communications, or other information provided to the affected people.

Record measures such as data minimisation, access restrictions, retention limits, pseudonymisation, security controls, recipient restrictions, review points, and arrangements for handling objections or requests.

List internal roles, external organisations, processors, or other recipients. State where access will occur and what access limitations apply.

State the retention period or review rule and explain how secure deletion or disposal will be managed.

Select the conclusion supported by the analysis. Do not allow the new-purpose processing to proceed while the conclusion is unresolved.

Summarise the reasons for the conclusion, including any conditions that must be met before processing starts and any matters requiring review.

Enter the reviewer or approver responsible for confirming that the assessment is complete and appropriate for the school's circumstances.

Enter the date on which the assessment was reviewed or approved.

Tick only when the statement is accurate.

• Tick when complete

State the review date or events that will trigger a review, such as a change in purpose, data used, recipients, technology, affected people, safeguards, or risk.