One of the clearest themes in the DfE's guidance on generative AI is data protection. If you are wondering what it actually recommends — and how that translates into what staff can type into an AI tool — here is the plain-English version.
The DfE's position in brief
The DfE's guidance on generative AI in education makes a few consistent points about data. In summary:
- Schools must protect personal and special category data in line with data protection law when using AI.
- Staff should be aware that generative AI tools may store and learn from the information entered into them.
- Pupils' original work should not be used to train AI models without appropriate consent or a legal basis.
- Schools should be transparent about how they use AI and pupils' data.
Our summary of the DfE's generative AI guidance covers the wider document.
What that means in practice
The account matters more than the tool
A personal, free AI account is not covered by your school's data protection arrangements. A school-licensed account — such as Copilot or Gemini on your school login — usually comes with contractual protections, including commitments not to train models on your data.
Minimise what you enter
Even in approved tools, enter only what the task needs. Most tasks — planning, letters, resources — need no personal data at all.
Special category data needs extra care
Health, SEND, ethnicity, religion and safeguarding information is special category data. It should only go into AI tools where your data protection impact assessment explicitly allows it, and often not at all.
Want a straight answer for your school?
Ask me anything about AI in your school — policy, tools, training or safeguarding. I reply personally, usually the same day.
Simple rules for staff
- Use only AI tools on your school's approved list.
- Use your school account, not a personal one.
- Never enter pupil names or identifying details into personal accounts.
- Anonymise wherever you can — "Pupil A", "a Year 5 pupil".
- Keep special category data out unless your policy explicitly allows it.
- If you are unsure, ask your DPO before, not after.
These belong in your staff AI acceptable use policy.
What if data has already gone into the wrong tool?
Tell your data protection officer promptly. They will assess whether it is a personal data breach and whether it needs reporting. See data breaches from uploading pupil names to ChatGPT and is ChatGPT GDPR compliant for school data?
For leaders
Complete a DPIA for each AI tool that processes personal data, keep an approved tools list, and train staff on the rules above.
Examples: allowed or not?
| Scenario | Usually OK? |
|---|---|
| Planning a lesson in Copilot on your school account | Yes — no personal data |
| Drafting a generic letter to all parents | Yes |
| Report comments using initials in a school-approved tool covered by a DPIA | Usually, if your policy allows |
| Pasting a named pupil's SEND report into a personal ChatGPT account | No |
| Uploading a class photo to a free AI image tool | No |
| Summarising anonymised meeting notes in an approved tool | Yes |
Pupil photos and AI
Images of identifiable pupils are personal data. Uploading class photos to AI tools — for example, to create cartoon versions for a display — needs a lawful basis, consent that covers it, an approved tool, and usually a DPIA. In most cases it is simpler not to. See AI-generated imagery risks in UK schools.
Transparency with families
Your privacy notice should mention how the school uses AI tools where personal data is involved. See how to explain AI use to parents.
Frequently asked questions
What does the DfE recommend regarding personal data and generative AI?
Protect personal and special category data in line with data protection law, be aware AI tools may store and learn from what is entered, do not let pupils' work train models without consent, and be transparent.
Can teachers put pupil names into AI?
Not into personal accounts. Only into school-approved tools where your policy and DPIA allow it, and anonymising is safer.
Is using ChatGPT with pupil data a GDPR breach?
Entering identifiable pupil data into a personal account not covered by school agreements can be a breach. Report it to your DPO promptly.
What is special category data in schools?
Health, SEND, ethnicity, religion and similar sensitive information. It needs extra protection and should rarely go into AI tools.
Do school Copilot and Gemini accounts protect data?
School-licensed accounts usually include contractual data protections, including commitments not to train models on your data.