Generative artificial intelligence (AI) and data protection in schools
How to address the potential data protection risks of using generative AI in schools.
Generative AI refers to any type of artificial intelligence that creates new digital content, such as text, images, videos or other data. Generative AI is developed through the analysis of large volumes of data to identify underlying statistical patterns.
This guidance is to help schools understand:
- how to protect personal data when using generative AI
- data protection legislation in relation to generative AI
- the risks and biases of AI to personal data
Watch the Department for Education (DfE) training video on protecting children’s privacy when using artificial intelligence.
In a school, generative AI tools can be used as a starting point to develop resources, including:
- lesson plans or activities
- questions and quizzes
- revision activities
- images to help with character descriptions or stories
- communications for parents and carers
- creating timetables
Any use of AI needs to be carefully planned, and what is appropriate in one setting may not be suitable elsewhere. Check with your data protection officer or IT lead for further guidance on what is acceptable to use in your school. You should always follow DfE’s AI policy paper and product safety framework, and align any AI use with the keeping children safe in education guidance.
The using AI in education settings page has free materials that support the safe and effective use of generative AI in education.
Use our posters to remind staff at your school about the important aspects of data protection, including the use of generative AI.
Generative AI tools could offer significant benefits in education, but they come with certain risks related to data protection.
Schools should be open and transparent about how they use generative AI tools. Staff, students, governors, parents and carers should understand how their personal data is processed.
Ofsted has published guidance on its use of AI and on the way it looks at AI during inspection and regulation.
The Joint Council for Qualifications guidance on AI use in assessments sets out best practice for learners and teachers to help them understand their responsibilities where AI tools are being used as part of qualification assessments.
For the latest guidance on how to use AI safely and effectively in schools, refer to generative AI in education.
The generative AI tools you use must comply with data protection legislation and your school’s data protection notice.
To protect data when using generative AI tools, you should:
- seek advice from your data protection officer or IT lead
- check that the type of tool being used is approved by your school
- understand how the tool uses personal data and whether this adheres to your school’s data protection policy
- acknowledge or reference the use of generative AI in your work
- fact-check results to make sure the information is accurate
Example
A school administrator wants to email a parent about their child’s behaviour. They are unsure how to word the email. The administrator enters notes into a free generative AI tool and asks the tool to create the email for them.
The school does not include any personal data. It adds the pupil’s name and class to the email once it has been generated by the AI tool.
Generative AI can help save time, especially with routine tasks, and you can achieve this without including personal data.
If you choose to enter pupils’ personal data into an AI tool, make sure you check with your data protection officer or IT lead that it is safe to do so.
You will need to ensure the personal data is protected within the tool and not used to further train the AI. This could result in a data breach, so you must discuss this with your data protection officer before using the tool this way. This should be included and updated as necessary within the data protection policy. Observing data protection principles while handling personal data in AI tools will help you comply with data protection legislation.
Some AI tools have age restrictions. You must review these before allowing pupils to access and use the technology.
The Information Commissioner’s Office has information on what to do if you want to use generative AI to profile children or make automated decisions about them.
The Local Government Association has published guidance for local authorities on responsibly buying AI and meeting responsibilities under data protection law and the Public Sector Equality Duty. Although the guidance is not written specifically for schools, it may be helpful when considering procurement.
Some generative AI tools process and store more information than just the text you enter into them.
Generative AI tools may collect and store additional data such as your school’s:
- location
- IP address
- system information
- browser information
The data collected by these organisations can be viewed or sold to third parties. You must include how any data is collected, processed and stored by generative AI tools in your school’s privacy notice.