AI and GDPR: What Primary Schools Need to Know

The single most important rule for AI and data protection in a primary school is simple: never enter identifiable pupil information into a public AI tool. That includes names, dates of birth, home addresses, SEND details, safeguarding notes, or anything that could identify a child, even indirectly.

Why this matters for AI in primary schools specifically

Most free consumer AI tools process what you type on external servers, and some use inputs to improve their models. Once information leaves the school's systems in that way, you've lost control of it — which sits uneasily with your obligations under UK GDPR and the Data Protection Act. Primary schools hold some of the most sensitive personal data of any organisation, covering children who can't consent to how it's used, which is exactly why this needs a clear, staff-wide rule rather than individual judgement calls.

What's usually fine

• Asking AI to draft a generic parent letter template (with no names inserted).
• Getting ideas for differentiating a lesson, described in general terms.
• Drafting a policy document, checklist, or non-pupil-specific resource.

What to avoid

• Pasting a pupil's actual report comments into a tool to "improve the wording."
• Asking AI to summarise safeguarding records or EHCP details.
• Uploading spreadsheets containing pupil names, even for a simple formatting task.

The anonymise-first habit

If in doubt, anonymise first — replace names with "Pupil A," remove dates of birth, and strip out anything identifying. This one habit, taught consistently in a staff briefing, prevents the vast majority of accidental data protection issues schools encounter with AI. Your school's data protection officer should be able to advise on tool-specific questions, and it's worth checking your chosen AI provider's data processing terms before wider staff rollout.