Bromcom MIS

Provider statement: Bromcom MIS is the school's central record system, used for pupil and staff records, attendance, assessment, behaviour, exams, timetabling, census and statutory returns, document storage and communication with parents by SMS, email and app, with optional modules for safeguarding, clubs and trips, online payments, finance and HR. Data comes from migration from the previous MIS, CTF and file imports, manual entry by staff, and parents through the MyChildAtSchool portal and app. Recipients include school staff according to role, parents and pupils through portals, Bromcom as processor, its hosting and SMS subprocessors, AI providers when AI features are used, payment providers for online payments, accredited support partners where the school uses one, trusts or local authorities through Vision, and third-party applications the school authorises through the API. The school also submits statutory returns from the system. Not independently verified.

Provider statement: pupils, parents and carers, staff and other authorised users. As a full MIS it holds identifiable pupil records, contact details, attendance, assessment, behaviour and exam data, and is used to produce statutory census returns, so schools should expect it to hold the pupil characteristics those returns require. The G-Cloud 15 listing describes SEND and EHCP records, Welsh ALN Individual Development Plans and safeguarding workflows including body mapping, concerns, chronologies and alerts. The safeguarding module is in the One-Stop Shop package. Staff records, and HR data where the HR module is used, are also held. Parent payment details for online payments are handled by payment providers. Support calls are recorded and may be transcribed, and the terms state that personal data shared during calls may be captured. This means special category, SEND and safeguarding data are processed. Not independently verified.

Provider statement: as the school's statutory record system, identifiable pupil and staff data is essential to the purpose and cannot be anonymised. The G-Cloud 15 listing states schools can configure roles, permissions, data fields and workflows, and the AI page says permissions control who can use Bromcom AI. Minimisation therefore depends on school configuration: which modules are switched on, who can see safeguarding and SEND records, which data is published to parents through MyChildAtSchool, and which third-party apps get API access. The general-knowledge AI chat does not need personal data, and the 2023 AI privacy policy says only what users type is sent to OpenAI. Schools should instruct staff never to enter pupil or staff details into AI prompts. Ask the provider: Can AI features be switched off entirely or limited to named roles? Can API access be restricted to specific data items per supplier? Not independently verified.

Provider statement: the privacy policy states Bromcom is processor for information uploaded to the MIS, with the school, trust or local authority as controller. The Standard Terms and Conditions say data protection obligations are set out in Schedule 1, but Schedule 1 is not included in the public terms document, so the processor terms could not be reviewed. Clause 24.2 also makes Bromcom and the school separate controllers for shared personal data, including parent, staff and student names, contact details, personal data captured by call transcription and support case details, which Bromcom may use for service improvement and internal training. Payment providers act as independent controllers for payment data. The 2023 AI privacy policy states that personal data a user types into the AI chat is held by OpenAI as data controller. An indexed copy of the trust centre lists Microsoft Azure (UK hosting), CM.com (SMS) and an unnamed AI voice platform as subprocessors; the full current list could not be retrieved because the trust centre page loads by script. Independently verified: Bromcom Computers PLC is on the ICO register of fee payers (Z5660020, expires 18 September 2027). The ICO register names DataCo International UK Ltd as DPO, while the privacy policy names Data Guard. The terms state the standard terms prevail over the signed contract and can be updated by Bromcom with immediate effect. Ask the provider: Please supply Schedule 1 and the full current subprocessor list. Who is your DPO? Can data protection terms be changed without our agreement?

Provider statement: the G-Cloud 15 listing gives data storage and processing locations as the United Kingdom on Microsoft Azure, and the indexed trust centre lists Azure in the UK for MIS hosting. International transfers are described for some processing: the privacy policy states that data shared with AI chatbot providers and payment providers may go to the US under Standard Contractual Clauses and the UK Addendum. The 2023 AI privacy policy states the AI chat is provided by OpenAI, a US company. The terms (clause 24.2.9) allow shared personal data to be transferred to the US with safeguards under UK GDPR. The AI page says Bromcom AI uses Microsoft Azure and OpenAI, without saying where AI processing takes place. Ask the provider: Where exactly is AI processing performed, Azure UK or OpenAI in the US? Which transfer mechanism applies to processor data in the MIS, if any leaves the UK? Which support, SMS and AI subprocessors can access pupil data from outside the UK? Not independently verified.

Provider statement: the G-Cloud 15 listing states schools can export data at any time, can receive up to two SQL backup copies per school free of charge if requested before the contract ends, and that MIS data and documents are deleted within 30 days of contract expiry, with backups taken before expiry deleted after 30 days. The terms (clause 11.3) say Bromcom will provide an electronic copy of the most recent customer data on or before termination and may then destroy it, without stating a timeframe. Daily backups are taken (clause 8.4). Audit and system logs are kept for at least 12 months. Retention of records during the contract is not stated and is presumably managed by the school. Bromcom's own retention for data it controls: support call recordings 3 years, other calls 12 months, meeting recordings 6 months, support AI chatbot logs 3 years; AI providers keep chatbot data up to 30 days and helpdesk voice agent data up to 730 days. For shared controller data, each party follows its own retention policy after the contract ends. Ask the provider: Does the MIS support automated deletion of leavers' records in line with our retention schedule? Will you confirm deletion in writing at contract end? How long do AI providers and Bromcom keep support transcripts that include pupil details?

Provider statement (G-Cloud 15 listing, checked 24 October 2026): ISO 27001 certified by Peers Quality Assurance Limited (accreditation date given as 6 May 2023), ISO 9001 certified, Cyber Essentials Plus (certificate number A8170396-742e-43f7-a88a-a327e97072a5), and PCI DSS for card-not-present payments via Worldpay. None of these was checked on an issuing body's register, and certificate expiry dates are not stated. Further claims: TLS 1.2 or above in transit, encryption of physical media, annual CREST-approved IT health check, multi-factor authentication and identity federation available, role-based access, multi-tenant logical separation, staff screened to BS7858:2019, real-time user and supplier activity audit information kept for at least 12 months, and a public service status portal. The terms say SMS messages are sent unencrypted. Breach notification timescales for the processor role would be in Schedule 1, which is not public; the terms give 48 hours only for shared controller data. Ask the provider: What is the breach notification timeframe for MIS data? Can MFA be enforced for all staff? Please supply current ISO 27001 and Cyber Essentials Plus certificates with expiry dates.

Provider statements, which conflict: the Bromcom AI page (last updated July 2024) says the assistant uses Microsoft Azure and OpenAI, that internal school data stays in the Bromcom cloud and is never shared with the AI, and that nothing sent externally to the AI is retained or used for training. The same page advertises coming features that analyse school data, including summaries covering attendance, behaviour and SEN and personalised report comments, so these claims may not hold for newer features. The 2023 AI privacy policy, still linked from the website, says the chat uses OpenAI's ChatGPT, that personal data typed into it is held by OpenAI as controller, and that OpenAI keeps API data for up to 30 days for abuse monitoring, accessible to its staff and contractors, while not using it for training. The November 2025 privacy policy describes AI chatbots and an AI voice agent with AI-provider retention of up to 30 and 730 days, and possible US transfers. The terms (clause 20.1) describe a publicly available large language model via a plugin and exclude Bromcom's liability for its use. AI is included only in the One-Stop Shop package. Ask the provider: Which AI features are live today and what data does each send? Is OpenAI a processor or a controller for school data? Is AI processing done through Azure in the UK or by OpenAI in the US? How long are prompts and outputs kept? Can the school switch AI off?

Provider statement: the MIS provides dashboards, Power BI integration and real-time analytics on attendance, behaviour, assessment, SEND progress and safeguarding, and Vision benchmarks data across schools for trusts and local authorities. Bromcom AI is advertised to identify trends linking attendance, behaviour, assessment and safeguarding, mark quizzes automatically, and (as a coming feature) summarise groups of pupils, including SEN, and draft personalised report comments. No automated decisions with legal or similarly significant effects on pupils were found in the sources. The risk is that AI-generated summaries or comments about individual pupils are used without adequate staff review. Schools should require human review of any AI-generated content about an identifiable pupil before it is shared or acted on. Ask the provider: Which features generate content about individual pupils, and how are staff prompted to review it? Not independently verified.

Provider statement: Bromcom's privacy policy explains its controller activities and directs individuals to the school, trust or local authority for MIS data. Schools can export data at any time in many formats to answer subject access and portability requests. For shared controller data, the terms make each party responsible for data subject rights and require reasonable mutual assistance. MyChildAtSchool users are bound by a separate MCAS User Acceptance Agreement on the trust centre, which could not be retrieved. Schools should name Bromcom as processor in their privacy notices, explain its separate controller role for support transcriptions and payments, and tell parents that payment providers act as independent controllers. Ask the provider: Please supply the MCAS User Acceptance Agreement and explain how parents' requests about app and payment data are handled. Not independently verified.

Risks specific to school use, based on the sources above: (1) Processor terms not public: Schedule 1 could not be reviewed. Safeguard: obtain and review it before signing. (2) Bromcom acts as an independent controller for shared data, including pupil names and support call transcriptions used for service improvement and training. Safeguard: limit what staff disclose on support calls, and ask whether the school can opt out. (3) AI data flows: conflicting documents on retention, controller status and location, with OpenAI described as controller for chat inputs. Safeguard: restrict or disable AI until clarified, and ban pupil data in prompts. (4) The terms can be changed with immediate effect without notice and override the signed contract. Safeguard: negotiate a clause requiring notice and agreement for data protection changes. (5) Lock-in: 5-year terms with automatic 5-year renewals and acceleration of remaining charges on early exit. Safeguard: diarise the 90-day notice point and agree the term length in the order form. (6) Highly sensitive safeguarding and SEND data in one system with portal and API access. Safeguard: review role permissions, parent portal publishing and API grants regularly, and enforce MFA. (7) SMS is unencrypted. Safeguard: avoid sensitive content in texts. (8) Liability excludes data loss. Safeguard: keep periodic exports and consider insurance.

For the school's data protection lead: an MIS processes the school's full pupil and staff records, including special category, SEND and safeguarding data, so a full DPIA is very likely to be needed. Questions to resolve with the provider: (1) Please supply Schedule 1 (data protection terms) and the full current subprocessor list. (2) Can the school opt out of Bromcom's separate controller use of shared data for service improvement and training? (3) Which AI features are live, where is AI processing performed, is OpenAI a processor or controller, how long are prompts kept, and can AI be disabled? (4) Who is your DPO, given the ICO register and privacy policy name different organisations? (5) What is the breach notification timeframe for MIS data? (6) Can data protection terms change without our agreement? (7) Please supply current ISO 27001 and Cyber Essentials Plus certificates with expiry dates. (8) Please supply the MCAS User Acceptance Agreement. (9) Does the MIS support automated retention and deletion of leavers' records?