The one rule before AI touches your schoolwork

The rule

Don’t put pupil personal data into a tool your school hasn’t approved. No names, no SEND details and nothing related to safeguarding.

Anonymise first. Check your school’s policy, and ask your data protection officer (DPO) if you’re unsure. It takes a few minutes.

Replace names with codes such as P1 and P2. Keep the key on your school system, never in the AI tool.
Remove details that could identify a pupil indirectly, such as dates of birth, unusual circumstances or names written on scanned work.
Leave out SEND, medical and safeguarding information entirely, even in anonymised form.

The DfE has published guidance on generative AI in education. You don’t need to memorise it, but four principles are worth knowing.

You stay responsible.
AI can support planning, resource creation and admin. Professional judgement, and accountability for what reaches pupils and parents, stays with you.
Protect personal data.
Pupil information must be handled in line with UK GDPR and your school’s data protection policies. If a tool isn’t approved by your school, don’t put pupil data into it.
Check every output.
AI tools can produce content that is inaccurate, biased or inappropriate for your pupils. Treat what they produce as a draft, never as a source.
Safeguarding and assessment still apply.
Think about how pupils might use AI, in line with your safeguarding policy and KCSIE. For qualifications, follow JCQ guidance and your exam board’s rules on AI in coursework and NEA.

Ask your SLT or DPO which AI tools are approved in your school, and what data can go into them.

Check the source

Guidance is updated over time. Read the current version on GOV.UK rather than relying on summaries, including this one.