It's the question every school asks, and the honest answer is more nuanced than yes or no. Here's what UK GDPR actually requires, where the real risk sits, and how schools can use AI without falling foul of it.
The short answer
The question isn't really "is ChatGPT GDPR compliant" — it's "would our use of it be compliant." GDPR governs what you do with personal data, not whether a tool carries a badge. A school can use AI perfectly lawfully by simply not putting personal data into it, or unlawfully by pasting a class list into a free consumer account.
The practical rule: if no pupil or staff personal data goes in, most GDPR concerns fall away entirely. That single discipline resolves the majority of school AI risk — and it costs nothing.
Where schools actually get into trouble
- Pasting pupil names into a chatbot to draft report comments
- Uploading a spreadsheet with pupil data to "analyse it"
- Putting safeguarding or SEND details into a tool to "summarise"
- Using personal free accounts rather than school-provided ones
- Assuming a tool is safe because a colleague uses it
Note that none of these are the tool's fault — they're use decisions, which is exactly where GDPR responsibility sits.
Free consumer accounts vs business/education versions
This matters. Free consumer versions typically offer weaker data guarantees and may use inputs to improve models. Business and education tiers generally offer stronger contractual protections, data handling commitments and administrative controls. If your school wants staff using AI on anything sensitive, the paid/education route is the appropriate one. See Microsoft Copilot for education and Google Gemini for schools, which many schools already have through existing licences.
What your school should have in place
- A clear rule that identifying pupil data doesn't go into AI tools
- An acceptable use policy staff have actually read
- A view from your DPO on which tools are approved
- A DPIA where personal data genuinely is involved
- Staff training, so the rules are understood rather than just published
An honest caveat
We're not lawyers and this isn't legal advice — your DPO and, where relevant, your local authority or trust are the right people to sign off your position. What we can tell you is that the schools who avoid problems almost always do so through one simple habit: keeping personal data out of AI tools entirely.
Want confidence your school's AI use is safe?
We help schools set clear, practical data rules staff genuinely follow. AskColin offers low-cost monthly support for schools — with one-to-one help whenever you need it, so there's always someone to ask. Practical, jargon-free, built around your staff.
Get AI support for your schoolFrequently asked questions
Is ChatGPT GDPR compliant for UK schools?
The better question is whether your use of it is compliant. GDPR governs what you do with personal data, not whether a tool carries a badge. A school can use AI lawfully by keeping personal data out of it, or unlawfully by pasting pupil information into a free consumer account.
Can teachers put pupil names into ChatGPT?
No. Entering identifying pupil information into AI tools is where schools most often get into difficulty. Work generically — draft a template comment or letter, then add pupil details yourself in your own secure school systems.
Is the free version of ChatGPT safe for school use?
Free consumer versions typically offer weaker data guarantees and may use inputs to improve models. Business and education tiers generally provide stronger contractual protections and admin controls. For anything sensitive, the education or paid route is the appropriate one.
What does a school need in place to use AI under GDPR?
A clear rule that identifying pupil data doesn't go into AI tools, an acceptable use policy staff have read, a DPO view on approved tools, a DPIA where personal data genuinely is involved, and staff training so the rules are understood rather than just published.