A GDPR Compliance Checklist for AI Tools in Schools

A GDPR-specific checklist for an AI tool covers four things a general privacy checklist doesn't isolate on its own: a documented lawful basis under Article 6, a Data Protection Impact Assessment (DPIA) trigger test under Article 35, a verified international transfer mechanism under Chapter V, and a working process for fulfilling data subject rights under Articles 15 to 22. Run every AI tool through all four before it reaches a class of GDPR-covered students, not just the two or three that feel most urgent.

Quick Answer: Before an AI tool touches a GDPR-covered student's data, confirm the lawful basis in writing (usually public task, not consent), test whether the tool triggers a mandatory DPIA (profiling, large-scale children's data, or novel technology all qualify), verify the transfer mechanism if the underlying model runs on US servers (Standard Contractual Clauses or an adequacy decision), and confirm the vendor can actually fulfill a data subject's access, erasure, or objection request within GDPR's one-month deadline. Skipping any one of the four leaves a documented gap, not a minor omission.

Say it's a Tuesday afternoon and your school, based in Dublin, is three weeks from rolling out an AI-assisted reading-assessment tool across Years 3 through 6. The vendor's pricing page says "GDPR compliant" in the footer. That phrase, on its own, answers none of the four questions above. This checklist exists to turn "GDPR compliant" from a marketing claim into four specific, checkable facts about the tool your school is about to sign for.

This piece is deliberately narrower than a general student-data-privacy checklist. For the six-stage data lifecycle (collection, minimization, retention, and so on) that applies across FERPA, COPPA, and GDPR alike, see EduGenius's Student Data Privacy and AI in Education: A Guide for Administrators. This one stays inside GDPR's specific legal machinery: the four items above, and only those four, in enough depth to actually apply them.

Does GDPR Apply to Your School Before You Run This Checklist?

GDPR binds any school established in the EU, EEA, or UK, and separately reaches any school anywhere that processes personal data of people physically located there, regardless of where the school itself operates. Confirming this first matters more than any single checklist item below, because building a GDPR compliance file around a US-only school with no EU or UK connection spends real staff time on a framework that doesn't actually govern it.

A few quick markers worth checking before continuing:

• Is your school established in the EU, EEA, or UK? If yes, GDPR (or UK GDPR, enforced by the Information Commissioner's Office) applies in full, regardless of your students' nationalities.
• Does your school enroll or process data for anyone physically located in the EU/EEA/UK, even a handful of exchange or dual-enrolled students? That slice of data falls under GDPR's Article 3 extraterritorial scope even if the rest of your roster is purely domestic.
• If neither is true, FERPA and COPPA are the frameworks that actually govern your AI adoption, covered in EduGenius's AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026).

If your school clears either marker above, the rest of this checklist applies to the relevant students' data, whether that's your entire roster or one exchange cohort.

The Four-Part Checklist at a Glance

Each of the four parts below maps to a specific GDPR article and a specific document your school should be able to produce on request. Treat the table as the map; the sections after it are the territory.

Part 1: Document Your Lawful Basis

Every use of personal data under GDPR needs one of six lawful bases named in Article 6, and for AI use in a state or maintained school, the correct default is almost always "public task," not consent. The checklist item here isn't just picking the right basis; it's writing that choice down before the tool goes live.

Which Article 6 Basis Actually Fits

Most classroom AI use falls into one of three realistic options:

1. Public task (Article 6(1)(e)) covers a state school's core educational function, teaching, assessment, and safeguarding included. This is the default for most AI-assisted instructional tools and doesn't require asking permission first.
2. Contract (Article 6(1)(b)) can apply to an independent school processing data as part of its enrollment agreement with a family.
3. Consent exists as an option but is usually the weakest choice for a school-student relationship, since GDPR requires consent to be freely given, and data protection authorities have repeatedly flagged the power imbalance between a school and a child.

Legitimate interests (Article 6(1)(f)) is available in narrower cases, mostly administrative processing at a private institution, since public authorities generally can't rely on it for tasks performed under their official authority.

What the Written Record Should Include

A lawful-basis record worth keeping is short, but it has to name specifics, not general reassurance:

• The specific tool and the specific processing activity it involves.
• The Article 6 basis relied on, and one sentence explaining why it fits.
• The date the basis was documented, and who reviewed it.
• Whether any special category data under Article 9 (health information, SEN records, biometric data) is involved, since that adds a second, stricter legal test on top of Article 6.

A basis chosen but never written down doesn't count as documented if a regulator or a parent ever asks. Keep the record wherever your school already tracks vendor approvals, not scattered across email threads.

Part 2: Run the DPIA Trigger Test

A Data Protection Impact Assessment is mandatory, not discretionary, once an AI tool crosses one of three thresholds under Article 35: systematic profiling, large-scale processing of children's data, or novel technology deployed at scale. For AI tools touching a classroom, assume a DPIA is required until the tool proves otherwise.

The Three Triggers, in Plain Terms

• Does the tool score, rank, or profile individual students automatically? An adaptive-difficulty engine or an AI tool that assigns a fluency or ability score to a named student typically qualifies.
• Does the tool process children's data at scale? Both the UK Information Commissioner's Office and the European Data Protection Board treat children's data as inherently higher-risk, which lowers the bar for what counts as "large-scale" compared with adult data.
• Is the technology itself novel? Generative AI, by the European Data Protection Board's own guidance, counts as novel technology in a way a long-established tool like a gradebook does not.

If any one of these three is true, the DPIA isn't optional. A tool that fails all three can skip the assessment, but that determination itself needs to be written down, with the reasoning, rather than assumed silently.

What a DPIA Actually Has to Contain

A DPIA doesn't need to be a month-long legal exercise, but it does need four specific components under Article 35:

1. A description of the processing and its purpose.
2. An assessment of necessity and proportionality against that purpose.
3. An identification of risks to students' rights and freedoms.
4. The specific mitigations put in place to address each identified risk.

Skipping the DPIA because a tool "seems fine" is exactly the gap that turned an AI-proctoring rollout into a formal finding against Bocconi University. Italy's data protection authority, the Garante, fined the university €200,000 in 2021 after its exam-monitoring software processed biometric data without an adequate legal basis, skipped a DPIA entirely, and transferred data to the US without valid safeguards, violating GDPR Articles 9, 35, 44, and 46 in one deployment (European Data Protection Board, 2021).

Part 3: Verify the International Transfer Mechanism

If the AI tool's underlying model runs on servers outside the EU/EEA/UK, most commonly in the United States, that's an international transfer under GDPR Chapter V, and it needs its own lawful mechanism separate from the Article 6 basis already documented. This is the checklist item schools skip most often, because it isn't visible from a product's login screen.

The Two Mechanisms That Actually Make a Transfer Lawful

A third option, Binding Corporate Rules, exists for large multinational vendors managing transfers across their own entities, but it shows up rarely in education-sector AI contracts specifically.

Why "We Use SCCs" Isn't the End of the Conversation

The EU-US Data Privacy Framework, the adequacy decision most US-hosted AI vendors point to, remains under active legal challenge, which means a vendor's stated mechanism is worth re-verifying periodically rather than treated as permanently settled. French MP Philippe Latombe's challenge was dismissed by the EU General Court in September 2025, with his appeal still pending before the Court of Justice of the EU. None of this means the Framework has been invalidated. It means the checklist item here is "name the mechanism and note the date it was last confirmed," not a one-time box to tick and forget.

Questions worth putting to any vendor directly:

• Which country does the underlying model actually run in?
• If it's outside the EU/EEA/UK, which specific mechanism applies, an adequacy decision or SCCs?
• Are the SCCs actually attached to our signed contract, not just mentioned in a public terms-of-service page?

Part 4: Confirm the Data Subject Rights Fulfillment Process

GDPR gives a parent or eligible student seven distinct rights over their data under Articles 15 through 22, and a vendor's contract needs to show it can actually support all seven, not just describe them in a privacy policy. This is the part of a GDPR checklist most likely to get treated as legal boilerplate rather than an operational test.

The Seven Rights a Vendor Contract Must Support

1. Right of access (Article 15), a copy of the personal data being processed.
2. Right to rectification (Article 16), correcting inaccurate data.
3. Right to erasure (Article 17), sometimes called the "right to be forgotten."
4. Right to restriction of processing (Article 18), pausing use without deleting the data outright.
5. Right to data portability (Article 20), receiving data in a structured, machine-readable format.
6. Right to object (Article 21), particularly relevant if a tool uses data for anything beyond the core educational task.
7. Rights related to automated decision-making (Article 22), relevant if an AI tool makes a decision about a student with no meaningful human review.

The One-Month Clock

Article 12(3) requires a response to a data subject rights request without undue delay, and within one month as a standard ceiling, extendable by up to two further months only for genuinely complex requests. The checklist question isn't whether the vendor's privacy policy mentions these rights; it's whether your school and the vendor together can actually produce a response inside that window if a parent asks tomorrow.

Confirm, in writing, before adoption:

• Who at the vendor handles a data subject rights request, and what's the vendor's own internal response time commitment?
• Does the school's own process route a parent's request to the right vendor contact without relying on one staff member's memory?
• Can the vendor produce a specific student's data in a usable format within the one-month window, tested once before go-live rather than assumed?

The Full Checklist in One Table

Pulling all four parts into a single reference makes this the document worth attaching to a vendor-approval file.

A tool that clears all six rows is genuinely further along than one carrying a "GDPR compliant" badge with none of them documented.

A Classroom Scenario: Running the Checklist on One Tool

Say you teach Year 4 at a school outside Manchester, and your department wants to pilot an AI tool that generates differentiated spelling and grammar exercises from a class roster. Before it moves past a single classroom, someone, ideally your school's data protection lead, walks it through all four parts.

Lawful basis: public task, since generating instructional materials sits squarely inside the school's core teaching function. DPIA trigger: the tool doesn't score or rank individual students and isn't itself novel beyond generative text generation, so a documented "no DPIA needed" note, not a full assessment, is the right record. Transfer mechanism: the vendor names its model provider and confirms SCCs are attached to the signed contract. Data subject rights: the vendor commits, in writing, to a two-week response time for access or erasure requests, comfortably inside GDPR's one-month ceiling.

A tool like EduGenius can fit into this kind of review as a class-profile-driven generator, producing worksheets from a grade level, subject, and ability range rather than requiring individual student accounts, which narrows what the lawful-basis and DPIA questions above actually have to cover. That structural choice still doesn't substitute for running all four parts of this checklist directly with any vendor, EduGenius included.

Tools and Vendor Questions Worth Asking

Beyond the four checklist parts above, a few cross-cutting questions are worth putting to every AI vendor during procurement:

• Is a signed Data Processing Agreement available for our specific institution, not just a public terms-of-service page?
• Does the vendor's no-training commitment extend explicitly to the underlying model provider, in writing?
• Who is our named contact for a data subject rights request, and what's their committed response time?
• How often does the vendor re-confirm its transfer mechanism, and will it notify us if that mechanism changes?

For how these same questions play out across FERPA and COPPA at once, not just GDPR, see Student Data Privacy and AI in Education: A Guide for Administrators. For the under-13 consent mechanics specifically relevant to a US-facing tool, see How Schools Can Use AI Without Violating COPPA.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Diffit and Student Data Privacy: What Teachers Should Know
• How Schools Can Use AI Without Violating COPPA
• Student Data Privacy and AI in Education: A Guide for Administrators
• Nearpod and Student Data Privacy: What Teachers Should Know
• SchoolAI vs Khanmigo: Which Is Better for Teachers?