The use of AI in relation to tracking students attainment must be done in line with existing data privacy regulations. The inputting of sensitive, proprietary or personal data should be avoided and GDPR applies. Educators must be aware of the AI systems they are using, ensuring that they are used in ways that are responsible, just, and fair.
The Department of Education and Youth’s Guidance on Artificial Intelligence (AI) in Schools, published in October 2025, emphasises the need to comply with GDPR and data privacy laws and to protect personal data when using AI tools. This includes ensuring that the AI systems used are reliable, fair, safe, and trustworthy and that the management of educational data is secure, protects the privacy of individuals, and is used for the common good. It recommends that the inputting of sensitive, proprietary or personal data should be avoided and GDPR applies.
In accordance with the provisions of the Education Act 1998, the board of management is the body charged with the direct governance of a school. Schools must comply with data protection requirements when requesting and collating information from parents and guardians. The responsibility for compliance with data protection legislation rests with each school board of management
Schools are data controllers and are therefore responsible for compliance with GDPR. Schools must comply with their GDPR obligations around how they collect and use personal data.
The Data Protection Commision (DPC)is the national independent authority responsible for upholding the fundamental right of individuals to have their personal data protected. It is the supervisory authority responsible for monitoring the application of the GDPR. The statutory powers, duties and functions of the DPC are as established under the Data Protection Act 2018.
In 2024 the DPC published a Data Protection Toolkit for Schools online to assist with specific concerns and challenges faced by schools, following consultation with a number of organisations in the education sector. The Toolkit is available on the DPC’s website and includes guidance on the use of technology in schools, including the arrangements of third-party service providers.
Schools can consult with their management body and/or the DPC if they require further advice.