AI and privacy
How schools use AI, why pupil data receives extra protection, which applications are prohibited or high risk, and what a school needs to arrange.
AI in education is permitted, but a school has little leeway with pupil data. It may process that data in an AI chatbot only with a data processing agreement, a clear purpose, a risk assessment and as little data as possible. A free or personal account does not meet those conditions. The education sector's own advice: do not enter personal data.
Use is already happening. Pupils use it for homework; teachers for lesson preparation. This article concerns what a school may do with pupils' data: what the GDPR says about children, what the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, Kennisnet and SURF have published, and what the AI Act prohibits or classifies as high risk. We checked sources on 13 October 2026. This is an explanation rather than legal advice.
The AP describes the development in its March 2026 statement about privacy risks of digital learning resources: notebooks and pens have given way to laptops, software and AI, allowing schools to track progress, offer tailored education and reduce teachers' workload. The downside, according to the AP: suppliers process much pupil personal data, including sensitive data about performance and behaviour.
| Application | Which data | What you arrange |
|---|---|---|
| Creating teaching materials or a test | No pupil data needed | Agreement that questions contain no names or files; a teacher checks the result |
| Writing an email to parents or a report | Name, notes about behaviour or home circumstances | Not in a general chatbot; use fictitious names or write it yourself |
| Marking tests or suggesting a grade | Name, class, submitted work, result | High risk under the AI Act; a DPIA, genuine teacher assessment, openness towards pupil and parents |
| Summarising a support plan or care file | Health, behaviour, assessment results | Special category data: only with a GDPR exception in an environment with a data processing agreement, or do not do it |
| Letting pupils use a chatbot themselves | Account data, everything the pupil types | School accounts, rather than personal accounts; watch age limits in the terms |
| AI monitoring during a test | Images, audio, behaviour during the test | High risk under the AI Act; inferring emotions is prohibited |
| Timetables and general administration | Employees' names, sometimes pupils' names | Data processing agreement with the supplier; check for AI features enabled without being requested |
As at 13 October 2026. The table is an aid rather than a classification of your application.
A tutor at the fictitious Voorbeeldcollege wants to prepare for a parent meeting. She pastes her notes about a pupil into a free chatbot: his name, frequent absences and his parents' divorce. The notes are then held by a provider with which the school has no arrangement, on an account the school does not manage.
Recital 38 GDPR says children merit specific protection for personal data because they may be less aware of risks, consequences and their rights. This protection applies particularly to marketing, creating personality or user profiles and services offered directly to children.
This carries through into the rest of the law. For legitimate interests, Article 6 says the data subject's interests may override them, “in particular where the data subject is a child”. Information for a child should also be simple enough for the child to understand.
The AP sets the threshold at 16. Its page on consent as a lawful basis says children under 16 cannot give valid consent themselves: a parent or guardian does so, and the organisation must demonstrate that it checked this. Children aged 12 or older may withdraw consent themselves.
In the statement accompanying its Education Sector Overview, the AP wrote that children and young people need extra protection because of their vulnerable position, so they can develop in a free and safe environment. The same statement identifies algorithms and AI as requiring further policy and finds limited control over software use in educational institutions.
A school processes most pupil data because it must provide education, rather than because parents said yes. Parents and pupils are also not on equal terms with the school, and consent can be withdrawn. Our article on GDPR lawful bases explains how the six bases work.
On its pupil file page, the AP lists possible contents: enrolment, departure and absence data, progress and results, parent meeting reports, health data needed for special support, and any psychological assessment results.
According to the AP, the file is sensitive because it systematically tracks a pupil's development and behaviour, contains special category data, and concerns particularly vulnerable children.
Health data falls under Article 9 GDPR. Processing is prohibited unless an exception applies, and an ordinary lawful basis is then insufficient. Summarising a care file or support plan in a chatbot is therefore a different matter from creating a test. Find the explanation in our article on special category data.
For pupil files, the AP lists further rules directly relevant to AI: process only what the purpose requires, give no more people access than necessary, include processing in the record of processing activities and carry out a DPIA for high risk. The general retention period is two years after the pupil leaves school. A copy in chat history escapes that cleanup; see our article on retention periods.
The AP has published no separate rules for school chatbots. Its March 2026 statement does call on schools and suppliers to make sound arrangements and be open. Schools must critically review existing supplier agreements and have them amended where necessary, jointly through organisations such as SIVON and Kennisnet if needed. Suppliers and schools should explain how pupil data is protected and retained, and whether it is used for profiling or AI training.
Kennisnet, the IT organisation for Dutch primary, secondary and secondary vocational education, has a school AI guide with a privacy section. Its main points, briefly:
Kennisnet warns that data entering training data is almost impossible to remove. The example arrangement in its school arrangements for generative AI is therefore brief: do not enter personal data.
SURF, the IT cooperative for Dutch secondary vocational, higher professional and university education, commissioned a DPIA on Microsoft 365 Copilot. The second update of 27 May 2026 appears in SURF's statement: two risks remain “orange”, and institutions are still advised to be cautious, assess suitability per use and weigh the risks. One risk concerns diagnostic data retained for up to 18 months. This is the May 2026 position; check whether anything has changed.
The VO-raad adopted the first advice for school boards in late 2024, with a detail relevant to schools: according to that statement, the DPIA examined employees and adult students because the paid education licence was then unavailable to minors. An adult assessment therefore does not automatically say anything about pupils.
In September 2026, SURF announced its own provision. According to the SURF AI statement, members in secondary vocational, higher professional and university education will gain access from January 2027 to AI infrastructure with its own chat application, with institutions deciding who may access which language models.
Article 5 of the EU AI Act prohibits AI systems inferring people's emotions in workplaces and educational institutions. The exception is a system used for medical or safety reasons. The prohibition has applied since 2 February 2025. You therefore may not deploy a tool inferring from a face or voice whether a pupil is bored, tense or engaged.
Annex III, point 3, lists four high-risk applications in education and vocational training.
There is an exception for systems posing no significant risk, for instance because they only perform a narrow procedural task. The exception disappears when the system profiles people. This appears in Article 6, explained in our article The AI Act explained.
Requirements for high-risk Annex III systems were due to apply on 2 August 2026. The digital omnibus moved this date. According to the European Commission, that amendment entered into force on 27 July 2026 and Annex III rules apply from 2 December 2027. Background appears in our article on the AI Act in autumn 2026.
The GDPR already applies, including to a marking tool.
A general chatbot was not made to assess tests. If you nevertheless use it for that, you are doing something listed in Annex III. Kennisnet explores this example: when a teacher has an AI tool assign grades, it involves assessing learning outcomes, may involve automated decision-making under the GDPR, and a teacher must always oversee, check the outcome and be able to depart from it. Kennisnet advises caution, particularly with tools not intended for this.
Kennisnet lists what a school using a high-risk system will need to do in Meeting the AI regulation's requirements: follow instructions, oversight by someone knowledgeable, monitor operation and report incidents, inform pupils and parents when AI contributes to decisions, and assess fundamental rights impacts. Our article on the FRIA covers the latter.
Article 4 of the AI Act applies to every school using AI, including outside high risk. Since the July 2026 amendment, the obligation is to take measures supporting employees' AI literacy without having to ensure a particular level per person. Read more in AI literacy is mandatory.
Our article on shadow AI describes what goes wrong without this. Our page on AI chatbots and the GDPR provides the general explanation.
PrivaSearch is neither a learning resource nor a marking aid. It does not assess pupils or make decisions. It makes documents searchable for employees after personal data has been replaced with pseudonyms and a colleague has checked this. The steps appear on How PrivaSearch works.
For an organisation with client files, this means an AI assistant searches released, pseudonymised passages rather than originals. You can connect Claude, ChatGPT Business and Mistral Vibe (formerly Le Chat). Anything you type into such an assistant yourself goes directly to its provider, outside PrivaSearch. Do not include names.
Three boundaries apply. Pseudonymised data remains personal data for the organisation. Detection is never complete, so human review is mandatory. And the assessment of whether an application suits pupil data, with the DPIA and data protection officer's judgement, remains the school's responsibility. The page on the GDPR and the AI Act lists the measures and starter documents involved.
To see how it works, book a demo.
Only if the school has arranged it: a data processing agreement with the provider, an established purpose, a risk assessment and as little data as possible. A free or personal account does not meet these conditions. Kennisnet therefore generally advises schools not to enter personal data into generative AI and to use fictitious or anonymous data.
Not all AI in education. The AI Act lists four applications: determining admission or assignment, assessing learning outcomes, assessing appropriate educational level and monitoring tests. These are in principle high risk, with requirements applying from 2 December 2027. Creating teaching materials without pupil data does not fall within this.
No. Since 2 February 2025, the AI Act prohibits AI systems inferring people's emotions in educational institutions. The only exception is a system used for medical or safety reasons. A tool inferring from a face or voice whether a pupil is focused or tense falls under the prohibition.
It is not prohibited, but requires a lot. Assessing learning outcomes with AI is listed as high risk in the AI Act, and the GDPR in principle prohibits fully automated decisions with major consequences. A teacher must check the outcome and be able to depart from it. Kennisnet advises caution, particularly with a general chatbot.
Consent is usually not the basis on which a school processes data and therefore not the solution for AI either. If a school does request consent, a parent or guardian must provide it for children under 16. More important is the school clearly telling parents and pupils which tools it uses and what happens to data.
Preferably not at the school's request. According to Kennisnet, the provider then processes pupil data without school arrangements, leaving the school without control over what happens to it. The advice is to use school accounts, teach pupils not to enter personal data and watch age limits in the terms.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
What ChatGPT stores, who can access it, how to turn off training, and what temporary chats, memory and shared links do. Includes a practical checklist.
Claude, Microsoft Copilot, Gemini and Mistral Vibe alongside ChatGPT Business: training, agreements, data location and administration. October 2026.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →