GDPR and AI tools for teachers: what you actually need to know

GDPR is one of those acronyms that generates more anxiety than understanding. Teachers know it matters, know it involves data, and know that getting it wrong could be serious — but the detailed guidance tends to be either too legal to be useful or too vague to be actionable.

Here is the version that actually helps.

What GDPR means for AI tools in schools

When you use an AI tool that involves pupil information — names, year groups, academic levels, SEND needs, anything that could identify a child — you are processing personal data. GDPR requires that this data is processed lawfully, fairly, and transparently, and that it is kept secure.

In practice, for AI tools, this means asking four questions.

Where does the data go? If you type a pupil's name and information into an AI tool, that information leaves your school's systems and goes to the company providing the tool. Where does it go from there? Is it stored? For how long? In which country?

Does it train AI models? Many general-purpose AI tools use the data you input to improve their models. In a school context, this means pupil data could be used for commercial AI training without the knowledge of the child or their family. This is a significant concern.

Is it covered by a Data Processing Agreement? Your school has a legal responsibility to ensure that any third-party processor of personal data has a signed DPA in place. A DPA sets out what the processor can do with the data and provides legal protections. If an AI tool does not offer this, it should not be used with identifiable pupil data.

Where are the servers? Data stored outside the UK or EEA requires additional safeguards. This is not automatically a problem, but it needs to be documented and checked.

Questions to ask before using an AI tool with pupil data

• Does pupil data get used to train AI models? (The answer should be no.)
• Is there a Data Processing Agreement available?
• Where is the data stored, and for how long?
• Is the company registered with the ICO?
• Has the school's DPO reviewed this tool?

If you cannot get clear answers to these questions, do not use the tool with identifiable pupil data. Use it with anonymised data, or don't use it at all.

What about general AI tools like ChatGPT?

General consumer AI tools are not designed for school use and do not typically offer GDPR-compliant data processing for schools. You can use them with anonymised information — “write a report comment for a Year 4 child who is strong in maths” — but you should not enter a specific child's name or identifiable details into a tool that is not confirmed GDPR compliant.