Good data protection practices ensure that an organisation and the individuals within it can be trusted to collect, store, and use personal data fairly, safely, and lawfully. This is particularly important regarding minors’ data, for which the UK Government has released updates to the following:
Record keeping and management
You can use a data retention schedule to document how long you’ll keep different types of data. The Data Protection Act 2018 and UK GDPR state you should only keep data for as long as needed. Each year, check what data you hold and if you still need to keep it. If any information is no longer required, dispose of it safely. It’s important to have policies and processes in place to prove and evidence that you’re not keeping data longer than necessary.
Generative artificial intelligence (AI) and data protection in schools
Generative AI refers to any type of artificial intelligence that creates new digital content, such as text, images, videos, or other data. Unlike traditional AI, which relies on exact programming to complete specific tasks, generative AI uses machine learning to create new digital content. Artificial Intelligence tools may share personal data with third parties – safeguard your students’ and your own personal information.
In schools, generative AI tools can be used to develop resources, including: lesson plans or activities, questions and quizzes, revision activities, images for character descriptions or stories, communications for parents and carers, and creating timetables. Check with your Data Protection Officer (DPO) for further guidance on what may be acceptable use for your school.
What you can do to help protect data:
- Check with your school’s DPO to find out if there are any AI tools approved by the school.
- Ensure it is safe and necessary to include personal data in your prompts or uploads.
- Verify that your activity aligns with your school’s data protection policy.
Remember: Need, read, proceed.
- Do you need to use AI? Consider if artificial intelligence will improve the outcome you’re trying to achieve.
- Have you read your school’s data protection policy? Your school might have approved AI tools you can use safely. Some AI systems learn from the data you upload, so it’s important to ensure you’re not inputting any personal or sensitive information.
- Review results and proceed with care. Always verify outputs from AI tools before relying on them. Fact-check for accuracy, relevance, and ethical compliance.
If you think there may have been an AI data breach, contact your designated AI DPO
Jonathan Gladwin PC.dp
Director – Data Protection, Security and Risk Management
E: jonathan.gladwin@tiaa.co.uk
Source: Updates – Data protection in schools – Guidance – GOV.UK