GDPR AI tools schools can trust: a DPIA checklist for leaders

Seven steps. That is what the Danish Agency for IT and Learning asks a school to run before an AI tool reaches a classroom, in its mini-guide on lawful use of AI (published January 2026). One of the steps is a systematic risk analysis, a DPIA, which the guide says is needed in almost every case where AI is used. This post is about the GDPR AI tools schools can actually sign off: the questions a municipality's data protection officer asks, and our own answers for GradeAid, in writing.

In May 2026 Jammerbugt Municipality in North Jutland slowed its use of AI after its data protection officer warned that nobody had an overview of which tools staff were using (Version2, 26 May 2026). I think that was a sensible call. A municipality that does not know which tools its teachers type into cannot write a DPIA for any of them.

GDPR is not the reason schools cannot use AI

We talk about GDPR as if it is the brake on AI in schools. It is not. It is a short list of questions that have to be answered before a tool is switched on, and most vendors have not answered them in plain words.

The Danish rules are clear about who asks. The Danish Ministry of Children and Education's guidance on lawful use of AI (May 2025) says the school or municipality is normally the data controller and the vendor is the processor. The controller carries the responsibility. The mini-guide adds that adopting a tool is a leadership decision, not one teacher's choice at a kitchen table at 21:00.

The same guidance says the Danish Data Protection Agency treats AI as new technology, so the risk is normally high and a DPIA will often be required. That is not a formality. It is a document someone signs with their name.

The rules are the same GDPR in Oslo, Stockholm, Madrid and Bucharest. The Danish guidance is simply one of the clearest written versions of them, which is why we use it here.

The GDPR AI tools schools can sign off answer five questions

When a data protection officer reads a vendor's paperwork, the questions come back to the same five. Here they are, with what a good answer looks like.

1. Who are the sub-processors, and where are they?

The ministry's guidance asks the school to find out, before processing starts, whether personal data leaves the EU and EEA, and to which country. If it does, the school needs a legal basis for the transfer, and for an unsafe third country a transfer impact assessment. A good vendor hands over one list: name, purpose, country, safeguard.

2. Is anything used to train a model?

The guidance says a school normally has no legal basis to let a vendor use kids' personal data for the vendor's own purposes, including training new models. The mini-guide's worked case on AI feedback only holds if the data processing agreement rules out model training. Ask for that sentence in the agreement, not on a marketing page.

3. What does the AI provider keep, and for how long?

This is where the fine print lives. Google's data governance page for Gemini on Vertex AI (last updated 30 October 2026) says Google will not train on customer data without permission. The same page says cached data can be kept for up to 24 hours, and that "Google may log prompts to detect potential abuse". Zero data retention is possible, but only if the vendor switches several settings off. Ask which ones are off.

4. Was the model itself built lawfully?

The European Data Protection Board said in December 2024 that a model developed with unlawfully processed data "could have an impact on the lawfulness of its deployment". A school cannot audit Google or OpenAI. It can ask the vendor which model it uses and what the model provider's terms say, and write the answer into the DPIA.

5. What goes into the prompt?

The mini-guide tells staff never to enter personal data, exam answers or grades. The best design makes that hard to get wrong: the teacher types a topic and a level, not a kid's name.

A DPIA is not a verdict on AI, it is a written answer to five questions about where the data goes.

Our own answers, in writing

It would be odd to publish this checklist and not run it on ourselves. Here is GradeAid, taken from our privacy policy (version of 30 October 2026).

Hosting, the database and file storage run on Google Cloud in Belgium. Content generation runs on Google's Gemini models through Vertex AI's EU endpoint. Today only teachers use the AI. The side of the platform for kids is paused, and the accounts kids used are deleted after 27 November 2026.

What we send to Gemini is the teacher's topic and level with personal identifiers removed, plus page images and text when a teacher uploads a textbook page. Google is contractually barred from training on it, and we do not train any model on uploaded material either.

Now the awkward part. Not everything sits in the EU. Transactional email goes through Postmark and billing through Stripe, both in the United States, under the EU-US Data Privacy Framework with standard contractual clauses as a back-up. Usage analytics (PostHog, hosted in Frankfurt) and Meta's ad measurement run only if the teacher accepts them in the cookie banner. A data protection officer should see that list before signing, not after.

The Vertex AI retention settings described above are a fair question to put to us, as to any vendor. We answer it in writing, together with the data processing agreement, which we send on request.

What a school can do

1. List every AI tool staff use, including the free ones open in a browser tab. A shared sheet with three columns is enough: tool, who uses it, what goes in. About 30 minutes in one staff meeting.

2. Send every vendor the five questions above in one email, and ask for the data processing agreement and the full sub-processor list. About 10 minutes per vendor. If nothing comes back, the checklist stops there.

3. Run the ministry's risk-assessment spreadsheet, the annex to the mini-guide, on each tool that answers. Two to three hours per tool for whoever owns GDPR, once.

4. Write the approved list in three lines: which tool, for what, with which data. Share it with staff and parents. About 45 minutes.

5. Put a date in the calendar to look again in twelve months, or sooner if a vendor changes its terms. Five minutes.

Where GradeAid fits

GradeAid is a Danish platform for teachers. The teacher types in the topic and the level and gets a lesson plan, a worksheet, a quiz, a presentation and screen-free activities in seconds, which you can also differentiate. The material can be printed. It sits on the teacher's side of the line, and we would rather a data protection officer read our sub-processor list before signing than find it afterwards.

If you work with data protection in a municipality or lead a school anywhere in Europe, we would like to hear from you. Write to us at founders@gradeaid.ai.