Can Staff Put Student Data Into ChatGPT? The Rule to Write

It is seven in the evening and a teacher is writing a support plan. She has the child's assessment in one window and a chatbot in the other, and she pastes three paragraphs across: the reading age, the two incidents last term, the thing the mother said at parents' evening. Then she types, "turn this into a plan the TA can follow."

Nobody has told her she may do that. Nobody has told her she may not. She is doing the job.

The honest answer to whether staff may put student data into ChatGPT is: sometimes, and it turns on three things, none of which is the tool's marketing. Whose account is it. What has the school signed. And what, exactly, is in the sentence. Get those three right and a teacher can use AI on real work about real children without anyone losing sleep. Get them wrong, or leave them undecided, and the default answer in your school is no, because nobody has said yes, and yet it is happening anyway at seven in the evening.

This piece gives you the test I ask leaders to apply, the four lines to put in front of staff, a six-point checklist you can copy into your next leadership meeting, the one place where the rule should be narrower than you think, and what to do if it has already gone into the wrong tool.

Can staff put student data into ChatGPT?

They can, but only inside an account the school controls, under terms the school has signed, and only with text that could not let a stranger identify the child. Outside those three conditions the answer is no.

Notice what that answer is not. It is not "is ChatGPT compliant?" Compliance is not a property of a product. Two schools can use the identical tool and sit in completely different legal positions, because one signed for it and one borrowed it.

Take the wording OpenAI uses for its school product. When it expanded ChatGPT for Teachers to 55 more districts on 26 August 2026, it said that "data shared in a ChatGPT for Teachers workspace is not used to train our models by default." Read that twice. Two conditions are doing the work: in a ChatGPT for Teachers workspace, and by default. A teacher signed in to her own account at her own kitchen table is in neither. Same brand on the screen, different promise entirely.

The UK position starts from the other end and arrives close by. The Department for Education's policy paper Generative artificial intelligence (AI) in education, last updated on 12 August 2025, puts it plainly: "It is recommended that personal data is not used in generative AI tools." Recommended, not forbidden, which leaves the decision where it belongs, with you. Most schools have not made it.

What is the Named Child Test?

The Named Child Test is three questions that settle, in about a minute, whether a particular sentence may go into a particular tool.

The Named Child Test is three questions I ask before anyone in a school types anything about a student into an AI tool: Could a person who has never met this child work out who it is from what I am about to type? Has the school, and not the member of staff, signed for this tool, on terms that say the supplier acts only on our instructions? And could the school say today which tool this went into, under whose account, and what that supplier is allowed to do with it? Text that survives all three can be typed. Text that fails any of them is not a member of staff being careless. It is a school that has not yet made a decision.

This is my suggested way of thinking about it, not a validated instrument and not legal advice. Its value is that it moves the question off the product, where nobody in the building can answer it, and onto three things a leadership team can settle in an afternoon.

1. Could a stranger work out which child this is?

Deleting the name is not the same as removing the child, and this is where most staff guidance quietly fails.

American law says so in as many words. FERPA's definition of personally identifiable information, at 34 CFR 99.3, covers not only the name and the identifiers but "other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty." The test is not whether the text names a child. It is whether somebody could work out who.

British guidance lands in the same place. When the DfE updated its Safe use of generative AI in education material on 19 May 2026, Schools Week reported on 28 May 2026 that it warns "even seemingly anonymous information can risk identifying a pupil if it is matched with other information."

Here is a hypothetical to make it concrete. A teacher strips out the name and types: "Year 9 student, joined in February, top set for math, wears a hearing aid, missed four weeks in the spring." There is no name in that sentence. In a school of nine hundred there is exactly one person it can be, and every adult in the building knows it.

Schools are small worlds, and small worlds re-identify people quickly. The practical version of this question, the one to give staff, is not "have I removed the name?" It is: if I read this aloud in the staff room, would anyone say a name back to me?

2. Has the school signed for this tool, or has the teacher?

The account is the whole game, and it is the part leadership teams keep delegating to individuals by accident.

On 9 September 2026 the American Federation of Teachers, the United Federation of Teachers and Microsoft announced a National AI Safety and Privacy Standard for schools. The standard itself, version 1.0, is blunter than most vendor language: the provider "absolutely may not use any Covered Data ... to train, fine-tune, update, benchmark, or otherwise improve any AI model," save for a narrow safety exception, and that restriction survives the end of the contract. The parties describe it as contractually enforceable and capable of being written into district agreements.

That is a real improvement, and it is worth saying so. But read what it is. It is a promise a supplier will make to a customer. It protects the district that signs it. It does nothing at all for the teacher who opened a personal account in August because the school had not given her one.

So the question to ask about any tool is not "is this one of the good ones?" It is: who is the customer here, and is it us? If the answer is a member of staff, your school has outsourced its data protection to whatever that person clicked through at eleven at night.

What the school then has to write for itself is a separate job, and I have set it out in what a school should require before approving an AI tool. The short version: a supplier's signature makes a product safe to use, and only the school can say what it is for. And a signature covers the product as it stood on the day it was signed, which is why an approved tool that changes underneath you has to be approved again.

3. Could you say today where this went?

If a parent asked tomorrow which tools hold information about their child, you should be able to answer without a meeting.

The AFT standard gives you the shape of the answer: providers must delete covered data from active systems within 180 days of a school's request, with backups purged on a documented cycle. Deletion rights are only worth having if you can say what to delete and where it is. A school that cannot name the tool, the account and the terms cannot exercise a right it has been given, and cannot tell a family the truth when something goes wrong. That is the same gap I wrote about in who is accountable when an AI tool gets it wrong.

What I See in Practice

The most common mistake is not a teacher typing something they should not have typed. It is a leadership team writing the sentence "do not put personal data into AI tools" and believing it has made a rule.

Across the leadership teams I work with on AI strategy, that sentence appears in almost every draft policy I read. It fails for a reason that is obvious the moment you look at the work rather than the document. The tasks where AI helps most are precisely the tasks that are most about a named child: reports, support plans, behavior logs, reference letters, the email to a parent that has to be right. A rule that forbids all of it has not restricted a practice. It has declared the most useful half of the job off limits and left the other half unaddressed.

What happens next is predictable and quiet. The work does not stop, because the work has a deadline. It moves to the personal account, where nobody can see it, and the school's position gets worse rather than better. I have written about that pattern at more length in what leaders should do about shadow AI.

The second pattern is more hopeful. Schools that have written one clear permission, naming a tool and a boundary, get far fewer questions than schools that have written three pages of warnings. Staff are not looking for reassurance. They are looking for a line.

What should the staff rule actually say?

A staff rule about AI and student data should fit on one side of paper and survive being read once, in a hurry, in September. These four lines are the ones I would put on it.

1. Use only the tools on our approved list, signed in with your school account. Never a personal account, for any task involving a student, ever.
2. Before you type, take the name out and then read it back. If a colleague could still say who it is, it is still that child's information. Change it or do not send it.
3. Nothing about special educational needs, safeguarding, behavior records or medical information goes into any tool until [named person] has confirmed which tool may be used for it.
4. The output is a draft and you are the author. Your name goes on it, so the checking is part of the job, not an optional extra.

Then two more lines that make the rule work: who to ask when the answer is not obvious, and who to tell when something has gone into the wrong place. Both need to be a named person, not a mailbox.

What should you check before you let staff use AI on student data?

Six checks, and the first one you cannot answer today is the one to spend this week on. Copy it into your next leadership meeting agenda.

1. The list. Is there a written list of approved AI tools, and does each entry say which account type staff must sign in with?
2. The signature. For every tool on that list, has the school or trust signed the terms rather than an individual member of staff, and can you name the person who holds the agreement?
3. The sentence rule. Have staff been given a one-line test for what may be typed, and has it been tried on this term's real reports, plans and letters rather than on a hypothetical?
4. The narrow band. Is there an explicit decision about special educational needs, safeguarding, behavior and medical information, naming the tool permitted for each or stating plainly that none is?
5. The record. Could you tell a parent tomorrow which tools hold information about their child, under whose account, and what the supplier is allowed to do with it?
6. The route back. Does every member of staff know the name of the person to tell when something has gone into the wrong place, and does that person know what to do next?

The pattern in the answers is more useful than the score. A team that says yes to all six has made the decision. A team that says yes to the first three has a rule and no accountability behind it. A team that says no to the first has a prohibition it has never written down, which is where most schools actually are. Governors will ask for the score; what they should ask for is which of the six is missing and who is fixing it, and that is the shape I argue for in what to report to governors about AI.

What should you do if student data has already gone into an unapproved tool?

Treat it as an incident from the moment you hear about it, open a written log the same day, and settle within hours rather than days whether it has to be reported, because in the UK the clock runs from the day you find out and not from the day it happened.

That last point is the one leaders most often get wrong. The Information Commissioner's Office says you must report a reportable personal data breach "without undue delay (if it meets the threshold for reporting) and within 72 hours", and that the clock begins "from when you discovered the breach, not when it actually happened" (ICO, 72 hours: how to respond to a personal data breach, undated guidance page, read 3 October 2026). So a teacher who tells you on Monday about something she typed in July has started your clock on Monday. If you are not sure it crosses the threshold, the ICO's own advice is to "start a log anyway, to record what happened, who is involved and what you're doing about it." Telling the families is a separate judgment: you have to tell them without undue delay where you think there is a high risk to them, and where you do not think there is, you do not have to.

American schools work to a different shape, and the difference matters because guidance written for one country gets handed to staff in the other. FERPA imposes no notification duty of that kind. The U.S. Department of Education's Privacy Technical Assistance Center states it plainly in its Data Breach Response Checklist, last updated in June 2012: "FERPA does not require an educational agency or institution to notify students that information from their education records was stolen." What it asks instead is that you notify affected individuals "as required by applicable federal, State, and local laws", and most states have a breach notification statute of their own. So the question for a US school is not what FERPA requires. It is what its state requires, and that is worth settling with counsel on a quiet afternoon rather than during an incident.

Five steps, in this order:

1. Record it the day you hear it. What was typed, into which tool, under whose account, roughly when, and who found out. The log is worth keeping whether or not you end up reporting.
2. Close the gap before you investigate the incident. Whatever produced one of these has usually produced several, and the second one is still being typed while you are investigating the first.
3. Decide reportability against your own jurisdiction's rule, within hours. In the UK that is the seventy-two hour threshold test from the day of discovery. In the US it is your state statute, not FERPA.
4. Use the deletion right, if you have one. Where the school signed for the tool, you can ask the supplier to delete. Where a member of staff signed for it, you have no route at all except that person's own account settings, and that asymmetry is the strongest argument for managed accounts you will ever put in front of a governing board.
5. Tell the family where the risk to them is high, and say what you have changed as well as what happened. A school that can describe the fix keeps more trust than one that can only quote the rule.

When I take leadership teams and governing boards through this, the gap is almost never the law. It is that nobody has decided who makes the call. The person who hears about it first is usually the most junior person in the chain, and the decision that follows needs somebody with authority to take it inside a day. Name two people rather than one, and make sure both of them know they are named.

Where should the rule be narrower? SEND and safeguarding

This is the one area where I would tighten the rule rather than trust the test, because the pressure to use AI is highest exactly where the data is most sensitive.

The DfE's updated material, as reported by Schools Week on 28 May 2026, permits staff to use AI to draft initial versions of support plans and template communications, and in the same breath tells them to be "extremely cautious" about entering information on a child's special educational needs, disabilities and additional support needs. It also draws a line at statutory documents: contributions to an education, health and care plan should not be written without significant professional review.

Both halves of that are right, and the tension between them is the actual leadership problem. The teacher writing a support plan at seven in the evening is being told, in effect, "this is the best use of the tool, and it is the most dangerous data you hold." She cannot resolve that on her own. Somebody senior has to decide which tool, in which account, with which text removed, and write it down.

Which decisions should never be handed over at all is a separate question, and I have answered it in which decisions AI should never make. Safeguarding pulls in a second direction as well. Keeping children safe in education 2026 widened the definition of a nude or semi-nude image to include ones generated by AI, which changes what staff have to recognize and report, and the four checks that follow from it are set out in what AI means for safeguarding in schools.

Should you just ban it? The honest counterargument

You can, and for a small school with no managed accounts and nobody to own the decision it may be the right call this term, but only if you say it with a date attached. Some leaders will read this and conclude that the safe move is a blanket ban on student information in any AI tool. It is a defensible position.

But be clear about what it protects and what it gives up. A ban you cannot support with an alternative does not stop the work; it relocates it. If you are going to say no, say it alongside a date by which you will say something better, and name the person who is working on it. A prohibition with an expiry date is a decision. A prohibition without one is a way of not deciding, and staff can tell the difference.

What should you do this term?

Five things, none of which needs a working group.

1. Name the tools. One short list, with the account type written next to each one. If the list is empty today, say so out loud rather than letting people assume.
2. Run the Named Child Test on the three tasks staff actually use AI for. Not on a hypothetical. On this term's reports, plans and letters.
3. Write the four lines and put a named person at the end of them.
4. Set the SEND and safeguarding boundary explicitly, because if you do not, it will be set by whoever is most tired on a Thursday night.
5. Name the two people who decide when it has already happened, and tell staff who they are, because in the UK the reporting clock starts on the day somebody tells you.

If your leadership team wants to know where it actually stands before it writes any of this down, that is the work I do through the School AI Readiness process, and it starts with what your staff would say if you asked them today. I also write about this each week in my newsletter.

The teacher at seven in the evening is not your risk. She is your evidence. She has shown you which job needs the tool and which decision nobody has made. Make it.

Sources and further reading

• OpenAI, Bringing ChatGPT for Teachers to more U.S. school districts, 26 August 2026.
• American Federation of Teachers, United Federation of Teachers and Microsoft, AI Safety and Privacy Standard for Schools, version 1.0, September 2026, and the announcement, 9 September 2026.
• Department for Education, Generative artificial intelligence (AI) in education, GOV.UK policy paper, last updated 12 August 2025.
• Department for Education, Safe use of generative AI in education: module 3, published 10 June 2025, last updated 19 May 2026.
• Schools Week, DfE guidance suggests using AI to draft SEND support plans, 28 May 2026.
• Family Educational Rights and Privacy Act regulations, 34 CFR 99.3, definition of personally identifiable information.
• Information Commissioner's Office, 72 hours: how to respond to a personal data breach, ICO SME web hub, undated guidance page, read 3 October 2026.
• U.S. Department of Education, Privacy Technical Assistance Center, Data Breach Response Checklist, last updated June 2012.

Dan Fitzpatrick is the founder of The AI Educator, a Forbes contributor and a bestselling author on AI in education, and has advised the UK Department for Education, KHDA Dubai and the Ministry of Education in Kazakhstan. More about Dan.