Educational institutions are required by privacy law to carry out DPIAs. Working together with SURF offers many advantages in this regard. To SURF's surprise, Xedule, a timetable software supplier widely used in vocational education, approached SURF itself with a request to organise a DPIA. In doing so, the supplier initiated a broad collaboration and increased awareness of privacy and information security.