How to do a DPIA for edtech in education
A DPIA guide and template approach for education: when colleges and training providers need a DPIA for edtech such as learner support software, and what to cover.
Guide · Data, AI and technology
Using AI safely in education: how FE colleges and training providers can use generative AI in learner support with data protection, human review and clear limits.
Guide at a glance
Checked against official guidance. Updated 9 October 2026.
AI can save learner support staff time on drafting and summarising, but only with clear limits: keep personal data out unless it is strictly necessary and protected, have a person meaningfully review every output, never let AI decide what support a learner gets, and assess the risks in a DPIA first. DfE guidance says staff remain responsible for anything they produce with AI.
Generative AI is already in FE. Staff use it to draft emails, summarise meetings and rewrite documents in plain English. In learner support, the time savings are tempting: a support plan drafted from conversation notes, a review summary in minutes, an easy-read version of a letter. But learner support records are among the most sensitive data a provider holds, and the people they describe are often young, disabled or vulnerable. The risks are real too.
This guide sets out where AI can help, where it should never be used, and the safeguards that make the difference. It draws on DfE guidance, the DfE product safety standards and ICO guidance. It is not legal advice, and the ICO notes that its AI guidance is under review following the Data (Use and Access) Act 2025.
DfE’s guidance on generative AI in education applies to schools and colleges in England. The points most relevant to learner support:
DfE also publishes product safety standards for edtech developers and suppliers, which colleges can use to assess products. They cover filtering, monitoring and reporting, security, privacy and data protection, intellectual property, design and testing, governance, and, since January 2026, cognitive development, emotional and social development, mental health and manipulation. Among other things, they say products should not use personal data for commercial purposes and should store only the minimum data necessary.
AI is most useful for low-risk drafting and formatting tasks where a knowledgeable person checks the result.
| Task | Risk level | Why |
|---|---|---|
| Rewriting a letter in plain English or easy read | Lower | Can be done without personal data; easy to check |
| Generating general adjustment ideas for a type of need | Lower | No personal data needed; staff choose what fits |
| Drafting a support plan from notes the learner agreed | Medium | Personal and special category data; output must be checked against the learner’s words |
| Summarising a review meeting | Medium | Risk of missing or distorting what the learner said |
| Suggesting which learners need attention | Higher | Profiling; risk of bias and of staff over-relying on it |
| Deciding eligibility, support level or funding | Do not use | Significant decisions about learners must be made by people |
| Anything about safeguarding or risk of harm | Do not use | Needs trained professional judgement and established procedures |
Draw firm lines and write them into policy.
Meaningful review is more than a click. A reviewer should:
Watch for automation bias, the tendency to trust a confident-sounding output. It grows when staff are busy. Building review into the workflow, with the AI draft clearly labelled until a person saves it, helps.
Fictional example. A learning support coordinator records a conversation with Aisha, 17, who says she finds group work stressful and wants to know the topic of each session in advance. An AI tool drafts a support plan section. The draft says Aisha “has social anxiety” and recommends “excusing her from group work”. The coordinator notices that Aisha never mentioned a diagnosis, and that she asked for advance notice, not to be excused. She rewrites the section in Aisha’s words and saves it as her own work. The draft saved time on structure; the human review stopped two errors reaching Aisha’s record.
Treat an AI feature like any other processing of special category data, with extra attention to where the data goes.
Ask how outputs differ across groups of learners, and test it yourself. Bias can appear in language, such as describing some learners in more negative terms, in suggestions, such as recommending different support for similar needs, or in omissions. Practical checks:
The ICO’s guidance on AI and data protection has a chapter on fairness that covers bias and discrimination.
Start small, measure honestly and be ready to stop. A sensible approach:
Expect some staff to be enthusiastic and others wary. Both are useful. The enthusiasts find uses; the sceptics find problems.
Keep it short and practical. A one-page policy for learner support teams might cover:
Link it to your existing data protection, safeguarding and acceptable use policies rather than duplicating them.
Inclusion Studio is learner support software being built for FE colleges and apprenticeship providers in England, currently pre-pilot with a prototype using fictional learners. Its AI drafts feature is optional and the full support journey works without it. Drafts are labelled, and a person reviews before anything is saved. AI never diagnoses, refuses support, makes decisions, shares externally, or is trained on case records. The prototype uses a sample draft. Gemini on Google Cloud Vertex AI is the selected AI provider. It has been exercised with synthetic data only, in a preview environment, at an EU multi-region endpoint accepted for preview use. Where real learner data would be processed is not decided, the live application uses a mock, and no real learner data has been sent to any AI provider. Our AI principles set out these commitments in full.
Not into general consumer tools. DfE guidance recommends keeping personal data out of generative AI tools and, where it is strictly necessary, taking all steps to protect it. Learner support data is often special category data, so use only tools your organisation has approved after a DPIA.
It should not. Decisions about support affect learners significantly and usually involve health or disability data. UK GDPR restricts significant decisions based solely on automated processing of special category data, and good practice is for a person to make every support decision.
The reviewer has the knowledge and authority to change or reject the draft, checks it against the source information and the learner's own words, and actually edits it where needed. Clicking approve without reading is not meaningful review.
Very likely. The ICO lists innovative technology such as AI among the factors that point to a DPIA, and learner support involves special category data about often vulnerable learners.
Only if you agree and there is a lawful basis, which is hard to justify for sensitive learner support records. DfE guidance also says schools and colleges must not allow students' original work to be used to train generative AI without permission. Check contracts carefully.
Yes. Be open in your privacy information about where AI is used, and label AI-drafted content so staff and learners know a person has reviewed it.
Official guidance changes. Check the source before relying on any detail, and take professional advice for individual cases.
We are working with a small number of England FE colleges and apprenticeship providers first. Tell us about your learner support and we will be in touch.