Home › Data protection & information security
Data protection is where most of the risk in AI-for-education sits. Get four things clear — whose data it is, your lawful basis, the supplier’s role, and how long data is kept — and most of the rest follows.
What it is
The section that fixes how personal data is handled when AI is involved: the rule that personal and special-category data stays out of AI tools; your lawful basis for any processing you do approve; the controller and processor relationship with each supplier; retention and deletion; and the route by which data entered in error is reported and dealt with.
Why it’s important
Controller or processor is the sector’s most common failing. Normally your school or trust decides why and how data is used (the controller) and the supplier only acts on your instructions (the processor). But the label in the contract doesn’t settle it; what the supplier actually does settles it. If a supplier uses the data for its own purposes, such as product development, analytics or improving its AI, it’s acting as a controller for that use, extra rules apply (including the Children’s Code where pupils are involved), and you should be asking why it needs to do this at all.
Your lawful basis is rarely consent. For most of what a school does, the basis is public task: part of running the school and educating pupils. Don’t confuse a tool’s terms requiring parent or guardian agreement with your lawful basis. They’re two different things.
Free text is easy to overlook. A tool that only asks for a name and email can still process sensitive information the moment someone types into a free-text box. The protection comes from the rule on what staff may enter, not from the sign-up form.
What good looks like
- Personal data stays out of AI tools by default; any exception is approved and written down.
- Each supplier’s role, controller or processor, is settled by what it actually does.
- A valid lawful basis is recorded, usually public task, rarely consent.
- Retention is configurable and kept short where possible, and the exit position (data deleted or returned) is in the contract.
- International transfers are covered by an approved arrangement, and you know who the sub-processors are and are told when they change.
The DPIA screening tool helps you work through roles, transfers, retention and sub-processors for a particular product.
Guidance it speaks to
- UK GDPR & Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025); ICO guidance on AI and the ICO AI & data protection risk toolkit.
- ICO Children’s Code, wherever children’s data is involved.
- DfE guidance on procuring edtech and data protection in schools; the ICO’s Edtech examined audit findings.
- DfE position on generative AI in education and the DfE generative AI product safety standards (January 2026).
A non-negotiable
A DPIA is completed before you deploy AI that processes personal data. Complete it as part of making the decision, not as paperwork afterwards.