Student data and AI

Why this matters

Schools and colleges hold a great deal of information about young people: names, dates of birth, family details, marks, attendance, health notes and sometimes discipline records. Much of it concerns children, who cannot fully protect themselves. When staff use AI tools, this data can leave the school without anyone noticing. Protecting it is a basic duty of care.

What counts as student data

Personal data is any information that identifies a student or could do so. In a school this includes:

• names, roll numbers and registration numbers
• dates of birth, addresses and parents' phone numbers or CNIC numbers
• marks, report cards and attendance
• health, disability or special needs information
• photographs and videos
• records of behaviour, complaints or family circumstances

Some of this is especially sensitive. Health information, disability and family problems can cause serious harm if they leak.

The basic rule

Never paste identifiable student data into a public chatbot or AI tool that your department has not approved for that data. Text typed into these tools is sent to the company that runs them. Depending on the tool and its settings, it may be stored or used to improve the service. See data leakage.

Instead:

• Use placeholders. Write "Student A" and "[marks]" instead of real names and figures.
• Use only what you need. If a task can be done without personal details, leave them out. This is data minimisation.
• Use approved tools only for any task that genuinely needs student data and follow your department's instructions.

Age and consent

Many AI services set a minimum age in their terms of use and some require a parent's permission for younger users. Before a school asks or allows students to use an AI tool:

• check the tool's own age requirements
• follow your department's instructions on student use of online services
• tell parents clearly what the tool is, what it will be used for and what data it collects
• give families a real choice where the law or your instructions require consent

Do not create accounts for children on AI services yourself, using their details, unless your department has approved this.

Photos, voices and images

Photos and recordings of students need extra care. AI image tools can alter faces and voices. Never upload students' photos or recordings to AI tools for editing, captions or effects unless your department has approved the tool and families have agreed. A photo shared once can be misused for years.

When something goes wrong

If you think student data has been pasted into the wrong tool or has leaked:

1. Stop using the tool for that task.
2. Tell your head teacher or the officer responsible for data straight away.
3. Note what was shared, where and when.
4. Follow your department's instructions for reporting the incident.

Hiding a mistake makes the harm worse. Reporting it quickly lets the school protect the students affected.

Try it

Take a real administrative task from your school, such as writing to parents about attendance. Rewrite the request you would give an AI tool so that it contains no student's personal data at all. Compare the two versions with a colleague: is anything identifiable still there?

Check yourself

1. Name four kinds of student data a school holds.
2. What should you do instead of pasting student names into a public chatbot?
3. What three steps should you take if student data may have leaked?