AI marking and student data: a GDPR checklist for international schools

By The Learning Mate team · Updated · 5 min read

An AI marking tool can be used in line with GDPR if the school has a lawful basis, a data processing agreement with the vendor, a clear picture of where data is stored and processed, and a guarantee that student work isn't used to train AI models. The UK Department for Education also recommends minimising personal data in generative AI tools, and requires permission before students' work is used for training. Ask the ten questions below before uploading any scripts, and expect clear written answers.

This is practical guidance, not legal advice. Your school's data protection officer should make the final decision.

Why exam scripts are sensitive data

A scanned exam script contains a student's name and handwriting. It may include candidate numbers, and sometimes personal content: English compositions often describe family, health or experiences. Marks and feedback are also personal data. Under GDPR, and the UK GDPR, the school is usually the controller and the marking vendor a processor. That means the school stays responsible for choosing a vendor that protects the data.

10 questions to ask any AI marking vendor

#QuestionWhat a good answer looks like
1Where are scripts and marks stored?A named region (e.g. "EU, France"), not "the cloud".
2Which third parties process the data, and where?A list of sub-processors, including the AI model provider, and their locations.
3Is student work used to train AI models?A clear "no" in the contract or terms, covering the vendor and its AI providers.
4Do you sign a data processing agreement (DPA)?Yes, with standard GDPR processor terms.
5How long is data kept, and how is it deleted?Defined retention, plus deletion on request within a stated time.
6Is data encrypted?In transit and at rest.
7Who at the vendor can see student work?Restricted access, for support only.
8Can the teacher control what students see, and when?Yes. Results should reach students only when the teacher publishes them.
9What happens to data transferred outside the UK or EU?Named transfer safeguards, such as standard contractual clauses.
10Can students and parents exercise their data rights?A documented process for access, correction and deletion.

What UK guidance says

The DfE guidance Generative artificial intelligence (AI) in education (updated August 2025):

  • Recommends that personal data is not used in generative AI tools. In practice, minimise what you upload. Don't include extra identifiers on scripts beyond what you need to return marks.
  • Says schools must not allow students' original work to be used to train generative AI models without permission.

The DfE's 2026 leadership toolkit adds that schools need a lawful basis for processing under UK GDPR and should keep an approved list of AI tools. The JCQ guidance on AI in assessments also asks schools to consider data privacy before teachers use AI to help mark.

International schools outside the UK should apply their own national data protection law, for example Spain's LOPDGDD alongside the GDPR, Egypt's Personal Data Protection Law, or the UAE's federal data protection law. The vendor questions above stay the same.

Practical steps for a department

  1. Get the tool approved by your data protection lead before the first upload.
  2. Tell students and parents in plain language what the tool does and how results are shared.
  3. Minimise data. Upload under the student's name in your class list. Avoid extra identifiers on the script itself.
  4. Use school accounts, not personal ones.
  5. Set a retention routine. Delete or archive mock scripts once they've served their purpose.

Our answers, for transparency

These are The Learning Mate's answers to the questions above. They summarise our terms and privacy policy, which take precedence.

  • Storage: files are stored on secure cloud servers in the European Union (France).
  • Processing: exam content and student data are processed by our hosting and AI providers in the European Union. Schools signing a data processing agreement can request the current list of sub-processors.
  • Training: our terms state that customer data is not used to train, fine-tune or improve general-purpose AI models.
  • Encryption: data is encrypted in transit and at rest.
  • Our role: we act as a data processor for schools. Our privacy policy describes how data subjects can exercise their rights.
  • Deletion: deletion requests are typically completed within 30 days.
  • Teacher control: every mark and comment can be edited, and results reach students when the teacher publishes them.

If your school needs a data processing agreement, contact support@thelearningmate.com.

FAQ

Is AI marking GDPR compliant?

It can be. It depends on the school having a lawful basis, a data processing agreement with the vendor, clear storage and processing locations, and no use of student work for model training.

Can AI marking companies use student work to train their models?

They shouldn't without permission. UK DfE guidance says schools must not allow students' original work to be used to train generative AI models unless they have permission. Check the vendor's terms and its AI providers' terms.

Do we need parental consent for AI marking?

Not always. GDPR offers several lawful bases, and schools often rely on public task or legitimate interests. Your data protection officer should decide, and parents should be told clearly how the tool is used.

Should we remove student names before AI marking?

Minimise personal data where you can. Many tools need some way to return marks to the right student. Avoid uploading extra identifiers or sensitive information that isn't needed.

Where is The Learning Mate's data stored?

Student work is stored and processed in the European Union, with files stored in France. Details are in our terms and privacy policy.

Sources