The privacy clauses your school AI policy needs

Two different problems

The first is a member of staff pasting pupil information into a general-purpose tool to get a report written faster. It is well-intentioned, it is quick, and the data has left the school’s control the moment it is sent. This is the one a policy clause can genuinely prevent, because it is a human decision made at a keyboard.

The second is a system the school bought that now has AI features processing pupil data inside it, sometimes enabled by an update nobody read. No staff clause reaches that. It is handled at procurement, through the contract, the processing terms and a DPIA — and it is the bigger exposure because it operates at the scale of the whole school rather than one teacher.

The clauses that do the work

• A hard line on what never goes into a general-purpose tool: pupil names, addresses, SEN and IEP detail, medical or behavioural information, safeguarding content, anything from a child-protection record.
• A stated alternative, because a prohibition with no alternative gets worked around. If staff may use a tool for planning or drafting with identifying detail removed, say so plainly.
• Human review before any AI-assisted output reaches a pupil, a parent or a school record.
• A rule that new AI features in existing systems are assessed before use, with a named person responsible for noticing them.
• A DPIA trigger: which kinds of new tool or feature require one before deployment.
• Transparency — what parents are told about AI used in their child’s education, and where that sits in the school’s privacy notice.

The questions to ask before buying

For any system with AI features that touches pupil data, the answers to these belong on file before the contract is signed, not after a parent asks:

• Where is the data processed, and does it leave the EEA?
• Is school data used to train the provider’s models, and can that be switched off?
• What is the retention period, and what happens at the end of the contract?
• Who are the sub-processors, and does the school get told when they change?
• What does the Data Processing Agreement say, as distinct from what the sales page says?

Schools are entitled to ask all of these and a serious vendor will have the answers written down. A vendor that cannot produce them has told you something.

The part that is not a document

Most inappropriate use of AI in schools is not defiance. It is a member of staff who did not know a line existed, under time pressure, trying to do their job well.

That makes acknowledgement the live question rather than a filing exercise. A school that can say which version of its AI policy is in force and which staff have read it is in a different position from one that cannot — both in a conversation with a parent and in deciding whether more training is needed, or whether the policy itself asks for something the job makes impossible.