It depends on whether they will have unsupervised contact with children. Many projects can be managed through supervision and site controls. Record your approach, set clear boundaries, and ensure everyone understands the reporting route for concerns.

Include your outcome, site context, required features, installation or rollout plan, support expectations, and what evidence you want back (references, documentation, training, and ongoing costs).

Keep processes simple, assign ownership, and plan a short staff briefing. Choose solutions with clear day-to-day workflows and realistic admin time.

Ask about data retention, who can access footage or logs, audit trails, how data is exported, and what requests are handled. Confirm where data is stored and how it is secured.

In most cases, yes — if the system involves monitoring people and processing personal data at scale, a DPIA helps you assess necessity, proportionality, retention, access controls, and risks. Keep the DPIA with your procurement evidence so you can show how privacy risks were considered and mitigated.

Alerts should be meaningful, prioritised, and routed to the right people. Confirm how alerts are generated, how they are triaged, and what the escalation process is.

Limit access to named roles with a clear purpose (e.g., safeguarding lead/site lead) and use role-based permissions. Set retention based on need and policy, keep it consistent, and document the rationale. Maintain an access/request log so you can evidence appropriate use.

Before you go live, map out how the change affects supervision, movement around site, and access to pupils. Update your visitor and site access process, confirm who monitors alerts or logs (and when), and run a short scenario test (for example late arrival, unknown visitor, pupil leaving class, lockdown). Make sure staff know the escalation route to the DSL or deputy, and set a review date after the first few weeks to fix any issues quickly.