UK GDPR and AI Tools: What Schools Actually Need to Check

Most AI compliance questions in schools come down to a handful of checks. None of them needs a legal background, but all of them need answering before a tool touches anything that identifies a pupil, a parent or a member of staff. This checklist is for headteachers, school business managers, data protection leads and governors who want a practical way to review a tool before it is used.

It is general information, not legal advice. Your school's data protection officer should be involved in any decision that affects personal data.

Start with the simplest check: should personal data go in at all?

Before any technical review, ask whether the task needs personal data in the first place. The Department for Education's guidance on generative artificial intelligence in education says personal data should not be entered into generative AI tools, and that where it is strictly necessary, schools must make sure their use complies with data protection law.

That single rule removes most of the risk. A teacher drafting a reading comprehension needs no pupil information. A leader summarising a policy document needs none either. If a task can be done without personal data, do it that way, and the rest of this checklist matters far less. The government's guidance on data protection in schools includes a section on generative AI and data protection, and is a sensible companion to this article.

Check 1: know what the tool does with your input

Ask the supplier directly:

• Are prompts and uploaded files used to train or improve the provider's models?
• How long are inputs kept, and can your school delete them?
• Is there a setting or account tier that switches training off?
• Who at the supplier can see the content of what your staff enter?

Consumer accounts and organisation accounts often behave very differently on exactly these points. A free account that a member of staff signs up to with a personal email address is not the same product, legally or technically, as an account the school has contracted for. If you cannot get a clear answer in writing, treat that as a warning sign.

Check 2: understand who is doing what

Under UK GDPR, the school decides why and how personal data is used, which makes it the controller. A supplier that handles personal data on the school's behalf is a processor, and the law expects a written contract between the two.

The ICO explains this in its guidance on contracts and liabilities between controllers and processors. Among the terms it lists are that the processor acts only on the controller's documented instructions, keeps the data confidential and secure, deals properly with sub-processors, helps the controller meet individuals' rights, deals with the data at the end of the contract and allows audits and inspections. The ICO notes that some of this guidance is under review, so check the current version.

In practice, ask whether the supplier offers a data processing agreement and read it. If a tool has only a standard set of consumer terms and no data processing agreement, it is unlikely to be appropriate for anything involving personal data.

Check 3: map the sub-processors

The vendor you contract with is rarely the only party involved. AI products often rely on other companies for hosting, model access and support. Ask for the list of sub-processors and note:

• who they are and what each one does;
• where each processes data; and
• how you will be told if the list changes.

A supplier that cannot or will not tell you who else handles the data is asking you to accept a risk you cannot see.

Check 4: find out where data goes

If personal data is sent outside the UK, the rules on international transfers apply. The ICO's guidance on international transfers explains the main routes: transfers to countries covered by UK adequacy regulations, transfers backed by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum, and a limited set of exceptions. In some situations the organisation must also carry out a risk assessment to test whether the safeguards are adequate.

You do not need to master the detail. What you need is a clear answer from the supplier: where is our data processed, and which transfer mechanism covers it? Your data protection officer can check the answer.

Check 5: write the impact assessment before rollout, not after

A data protection impact assessment, or DPIA, is a structured way to identify and reduce risks to individuals before you begin. The ICO's guidance on data protection impact assessments says one is required when processing is likely to result in a high risk to individuals, and lists the use of innovative technologies among the factors that can point that way. Processing that involves vulnerable individuals is another, a group that can include children.

A DPIA is far quicker when the scope is narrow. A useful one covers:

1. The specific use. What exactly will staff use the tool for?
2. The data involved. What personal data, if any, and whose?
3. Who has access. Staff, the supplier and any sub-processors.
4. The risks. What could go wrong for the people concerned?
5. The mitigations. What you will do to reduce each risk, and who owns each action.

Revisit it whenever the use widens. A tool approved for drafting letters should not quietly become a tool for processing pupil records.

Check 6: lawful basis and transparency

Under UK GDPR you need a lawful basis for using personal information. The ICO sets out the options in its lawful basis guidance, and your data protection officer can advise on which applies to your use.

People also need to be told how their information is used. If a tool changes what your school does with personal data, your privacy information may need updating. The DfE guidance recommends that schools consider how they engage with parents about the use of AI tools, so an honest, plain-English explanation is good practice as well as a compliance step.

Check 7: security, access and breaches

Ask how the supplier protects data, who inside your school can use the tool and what happens if something goes wrong. The government's guidance on data protection in schools includes a section on managing breaches of data, and it is worth making sure that staff know that sending personal data to an AI tool by mistake may be a data breach, and that they should report it internally straight away. A clear internal route for raising concerns matters more than any technical control.

Check 8: pupils' work and intellectual property

The DfE guidance says schools should not allow pupils' original work to be used to train AI models without permission from the pupil or their parent or guardian. It also warns of intellectual property risks, including secondary infringement if AI outputs draw on unlicensed material. Check what a supplier says about ownership and reuse of anything your staff or pupils upload.

Check 9: plan your exit

A review that ends at "yes, we can use it" is incomplete. Ask what happens when you stop. Can you delete everything you entered? Will the supplier confirm deletion in writing? The ICO's list of contract terms includes dealing with the data when the contract ends, so this is a normal thing to ask.

A simple record to keep

Each time you review a tool, keep a short record. It does not need to be elaborate. A single page with these headings is enough:

• the tool and the supplier;
• what staff will use it for;
• whether personal data is involved;
• the contract or data processing agreement in place;
• the sub-processors and where data is processed;
• the DPIA, if one was needed, and the date;
• who approved it and when it will next be reviewed.

If anyone later asks why the school adopted a tool, the record answers the question.

Warning signs

Be cautious if a supplier:

• cannot say whether your inputs are used to train models;
• offers only consumer terms and no data processing agreement;
• will not name its sub-processors;
• cannot tell you where data is processed;
• has no clear way to delete your data; or
• tells you compliance is "taken care of" without showing you how.

None of these is automatically a reason to walk away, but each needs a satisfactory answer before the tool is used with personal data.

Where to go from here

You do not have to answer every question on day one. Start by keeping personal data out of AI tools, agree an approved list, and review each tool against this checklist before adding it. Involve your data protection officer early, and keep the record.

If you would like help building this into your school's approach, you can read more about AI training for UK schools, or see how we support primary schools in East Sussex. You can also book a free 15-minute call to talk through where you are starting from.