Schools white paper on AI and data: Insights for school leaders

The schools white paper is ambitious. Chapters six and seven envision a more collaborative, technology-enabled education system where EdTech plays an evidenced and accountable role and AI begins to find its place in the classroom. But ambition without practical support risks leaving schools exposed to the following challenges.

1. Collaboration means data sharing – and schools need a framework for it

Chapter six focuses on collaboration between schools and partners. It's encouraging but skirts a critical point: collaboration means data sharing. The current landscape for sharing data between schools, trusts and external organisations remains complex, inconsistent and a source of real anxiety.

Schools shouldn't have to start from scratch every time. Yet each new partnership or referral pathway requires them to build data sharing agreements with limited specialist support and significant uncertainty about compliance.

The case for a national data sharing framework

What we'd like to see is a national data sharing framework: standardised, pre-approved agreements and templates that schools can adopt and adapt, with a clear expectation that appropriate sharing is not just permitted but encouraged.

The DfE's commitment to improving transparency where resources are pooled is welcome, but transparency must extend beyond finances to cover how children's personal data flows between organisations, who can access it, on what basis and why.

2. Parental complaints and the transparency gap

Complaints here are rarely about genuine breaches. They're rooted in a lack of understanding – a parent discovering that someone outside their child's school has accessed information about their child. Without a clear national framework and consistent communication, schools bear that burden alone.

3. EdTech accountability: Why the burden should shift from schools to the system

Chapter seven is the standout section. The government's commitment to education technology innovation is a recurring theme, but one aspect here represents an important reframing of responsibilities.

For too long, schools have navigated the EdTech marketplace alone, with purchasing decisions driven not by pedagogy but by fear of missing out. That's not a sound basis for investment decisions affecting children's learning and involving sensitive personal data.

Who should be responsible for EdTech standards?

The white paper's commitment to helping schools navigate towards effective commercial solutions is welcome. But more significant is the shift in responsibility. The DfE is clearly stating it will work with industry to drive adoption of standards, and that the onus lies with the DfE and the EdTech sector, not individual schools. That's the right approach. Schools should be consumers of a well-regulated marketplace – not its quality controllers.

4. AI in the classroom: Why data protection groundwork can't wait

The white paper's commitment to developing AI tutoring tools for secondary pupils by the end of 2027 is bold. The short timeframe should prompt urgency not just about the technology but about the data protection and AI risk assessment infrastructure that must accompany it.

Schools deploying AI tools processing personal data must carry out Data Protection Impact Assessments (DPIAs) where there's a high risk to data subjects. Most are starting from scratch with general guidance not tailored to AI processing involving children's data. That's unsustainable as AI adoption accelerates.

Why schools need standardised DPIA templates for AI

We'd like to see the DfE produce standardised DPIA templates that schools can adapt for common AI use cases. The responsibility must remain with the data controller, but well-constructed starting points, worked examples and clear explanations of key risks would significantly reduce the burden and improve consistency across the sector.

Biometric data risks: AI eye gaze software in schools

Software tracking eye movements may involve processing biometric data – particularly sensitive under data protection law and understandably alarming to parents. Clear communication about why that processing is lawful, what safeguards exist and why it's in children's interests will be essential if schools are to deploy these tools without generating significant parental anxiety.

5. The data spine: Lessons from the NHS the DfE must heed

Perhaps the most ambitious proposal is the concept of a "data spine" – sector-wide data access enabling different platforms to share information consistently. The vision of interoperability underpinning the education sector is compelling.

What the NHS digital programme teaches us about education data

Anyone who has followed the NHS's digital programme will recognise the challenges: interoperability across fragmented legacy systems, competing interests and varying digital maturity. The education sector faces a comparable challenge with its diverse ecosystem of schools, trusts, local authorities and third-party providers.

We'd hope the DfE has a robust plan that takes full account of those complexities, engages seriously with the data protection implications of a national infrastructure involving children's data and doesn't underestimate the scale of work involved. The ambition is right. The execution will be everything.

Practical support, not just aspiration

The common thread across both chapters is clear: the vision is ambitious and broadly welcome, but the gap between aspiration and practical reality remains significant. Data sharing frameworks, DPIA templates, standardised risk assessments, clear public-facing communication and a credible delivery plan for the data spine are all essential if these ambitions are to be realised in classrooms rather than just in policy documents.

Schools are ready to collaborate, innovate and embrace technology that improves outcomes for children. They need the infrastructure and support to do so with confidence. The white paper points in the right direction. Now the DfE must do the detailed work to get them there. In the meantime, see our data protection guidance for schools and trusts for more information.