# Institutional data-processing schedule

DRAFT PLANNING TEMPLATE — not an executed agreement, completed test, certification or delivery record. Prepared 19 September 2026. Complete, review and approve before institutional rollout. Do not enter real student data in public copies.

Complete with the actual contracting entities and a qualified legal reviewer. This is not a DPA by itself.

- Controller legal name/address and authorised contact: [confirm]
- Processor legal name/address and authorised contact: [confirm]
- DPO/representative applicability and contact: [assess]
- Instructions, duration, purpose, subject groups and data categories: [specify]
- Purpose-by-purpose lawful basis and special-category basis if applicable: [document]
- AI input minimisation and approved providers/models: [specify]
- Provider training, retention and processing locations: [verify account settings and contract]
- Subprocessor authorisation and change notice: [agree]
- International transfers and applicable safeguards: [review]
- Access matrix, authentication and tenant-isolation evidence: [attach]
- Encryption scope, key custody, recovery limitations and plaintext locations: [attach]
- Breach identification, reporting contacts and applicable deadlines: [agree]
- Rights handling, identity checks, response deadlines, requests log and escalation: [agree]
- Retention periods/criteria by dataset; backup expiry; legal holds: [approve]
- Export/return, deletion and provider/backup verification: [agree]
- Audits, assistance, confidentiality, liability and termination: [agree]
- Authorised signatures/date/version: [complete]

Do not assert GDPR compliance, complete erasure or a no-training guarantee from this template or a cookie banner alone.