Start with personal data
UK GDPR becomes relevant when an AI tool processes personal data. In schools, this can happen more quickly than you might think: pupil work, comments, images, voice recordings, adjustments, assessments and class information can all identify a pupil.
Purpose
Decide why AI is being used: planning, practice, feedback, support or administration. The same tool may be appropriate for one purpose and unsuitable for another.
Lawful basis
The school must be able to demonstrate why personal data is being processed. Consent is rarely a reliable solution due to the power imbalance between school and pupil.
Data minimisation
Use as little information as possible. Replace names with roles, remove unnecessary details, and use example material when AI is only supporting structure or language.
Security and agreements
Check where data is processed, how it is stored, whether it is used for training, and if a data processing agreement is required.
Information and responsibility
Pupils, parents and staff need to understand which AI tools are being used, for what purpose, and what data may be processed.
What should not be entered into open AI tools
A simple rule of thumb: if information can be linked to a pupil, class, parent or staff member, the school must consider data protection before sending it to an AI system.
Pupil work containing names or clear context
A piece of work may include names, relationships, health, home circumstances or other details even if a national insurance number is not present.
Assessments, grading evidence and marking comments
Assessment relates to a pupil’s performance and may be sensitive in practice, even if it is not formally classified as special category personal data.
Protected personal data
Information about pupils or staff with protected identities requires particularly strict procedures and must not be processed in open AI services.
Health, SEND, support measures and absence
Information about health, disabilities, additional support or special educational needs is often particularly sensitive and requires strong protection.
Images, audio and video of pupils
A pupil’s voice, face or classroom environment can identify individuals and may reveal more than is immediately apparent.
Parents and social circumstances
Family circumstances, conflicts, concerns, contact details and social information must be handled with great care.
Red, amber, green: AI and pupil data in schools
Use this model as a quick initial check within your team. It does not replace the school’s legal assessment, but helps clarify everyday decisions.
Red
Do not paste
Information that could identify a pupil or reveal sensitive details must not be entered into open AI tools.
- Pupil work containing names or clear context
- Health, SEND, support measures or absence
- Protected personal data, images, audio or assessment materials
Amber
Requires procedure or decision
Use may be appropriate, but only if the school has defined the tool, purpose, responsibilities and how data will be processed.
- AI support for feedback or assessment
- Pupil accounts in external AI services
- Material that has been anonymised but may still contain clues
Green
Often low risk
Workflows where the teacher uses subject, objectives or general material without submitting personal data.
- Lesson ideas, activities and quizzes based on subject or objectives
- Alternative explanations and examples without pupil data
- Critical evaluation of AI responses together with the class
Common data protection mistakes when schools start using AI
Risks often arise in everyday situations: a teacher wants to save time, a pupil’s work is pasted in, an account is created in an external service, and no one is quite sure what happens to the information.
Situation
Risk
Better procedure
The teacher pastes a pupil’s work into an open chatbot
The work may contain personal data and be processed outside the school’s approved tools.
Remove identifying details, use example text or an approved tool with clear terms.
Pupils are asked to create accounts in an AI service
The school or trust may become responsible for the processing and must be able to demonstrate compliance with UK GDPR.
Decide centrally which pupil tools may be used and inform pupils and parents.
AI is used to support assessment without a clear process
Unclear accountability, lack of transparency, and risk of sensitive pupil information being disclosed.
Use AI as a support tool, not as the decision-maker. Record teacher oversight and avoid unnecessary pupil data.
The school lacks a shared set of rules
Different teachers make different judgements about what is acceptable, leading to uncertainty and inequality.
Develop a local AI policy with approved tools, prohibited uses, and examples from classroom practice.
A practical routine before using AI with school data
You do not need to start with lengthy policy documents. Begin with a simple check that teachers and school leaders can actually follow.
1. Classify the information
Is it public material, anonymised content, pupil data, sensitive information, or protected personal data?
2. Check the tool
Is the tool approved by the school’s data controller? Are terms, responsibilities, security, and any data processing agreements in place?
3. Minimise before sharing
Remove names, personal details, class information, and unnecessary context. Use examples where appropriate.
4. Maintain human oversight
AI can suggest, structure, and draft. The teacher remains responsible for quality, fairness, and educational judgement.
5. Document the school’s approach
Record which uses are permitted, which require special consideration, and which are not allowed.
How teachers can use AI without disclosing pupil data
Many AI workflows can be used safely if the teacher controls the input. There is no need to rely on submitting personal data.
Generate lesson ideas from subject, curriculum objectives, or core content without using pupil names.
Create quizzes and exercises from textbooks, key concepts, or the teacher’s own instructions.
Ask AI to suggest alternative explanations, levels, or examples based on anonymised needs.
Create assessment rubrics, feedback templates, and checklists without pasting in pupil work.
Use AI with the class on a large screen to discuss factual errors, source reliability, and prompts.
Why schools need more than an open chatbot
Open AI chat tools can be useful for ideas, but schools often need clearer workflows: what should be created, what data is needed, who reviews, and how is material shared?
Make AI use safer before it becomes routine
When the school decides which data can be processed, which tools are approved, and how teachers should work, AI becomes easier to use responsibly.
Try Studera.AI for freeSources and Further Reading
This page links to UK government and regulator guidance on UK GDPR, AI, schools and data protection. Always check your school's own policies and legal assessments before introducing new AI tools.
Frequently Asked Questions about AI and UK GDPR in Schools
Does UK GDPR apply when teachers use AI?
Yes, if the AI tool processes personal data. In schools, pupil work, images, reports, support needs, class information and comments may all be considered personal data if they can be linked to an identifiable individual.
Can teachers paste pupil work into ChatGPT or other open AI tools?
This should not be done without a clear decision from the school or trust. Pupil work may contain personal data and sometimes highly sensitive information. Use anonymised material, example texts or approved tools.
Is it enough to remove the pupil’s name?
Not always. A text may still identify a pupil through its content, context, class, events, or details about family, health or support needs. Data minimisation means removing all unnecessary identifying context.
Who is responsible if pupils are asked to use an AI tool?
If the school asks pupils to use an AI tool, the trust must be able to demonstrate that its use complies with relevant regulations, including UK GDPR. Therefore, pupil-facing tools should be approved centrally and not left to individual teachers.
Is Studera.AI safer to use than an open AI chat?
Studera.AI is designed for school workflows: lessons, quizzes, assessment, study tools and AI assistants. This makes it easier to work in a structured way, minimise unnecessary pupil data and keep teachers in control. As with any digital tool, schools must still follow their own UK GDPR procedures and decide how the tool should be used.
Can AI be used safely in teaching?
Yes, but its use must be managed. Schools should use approved tools, minimise personal data, document procedures and ensure teachers retain responsibility for quality, assessment and monitoring.