AI tool summary for DPOs and governors
Adobe Firefly (education)
Adobe · Facts last checked 2026-10-23 · Printed 23 October 2026
AI Prefect
Staff: Amber · Use with caution
- Doesn’t say if it is a processor or controller
- Doesn’t say where data is stored
- 4 of 6 key fields not stated
Pupils: Amber · Use with caution
- Doesn’t say if it is a processor or controller
- Doesn’t say where data is stored
- 4 of 6 key fields not stated
| Supplier | Adobe |
|---|---|
| Category | image generation |
| Pupil-facing | yes - via Adobe education accounts |
| Processor or controller | not stated |
| Where data is stored | not stated |
| Trains AI models on inputs | no - Firefly not trained on customer content; trained on Adobe Stock, licensed and public-domain content |
| How long inputs are kept | not stated |
| Data processing agreement (DPA) | https://wwwimages2.adobe.com/content/dam/cc/en/legal/servicetou/Adobe-EDU-Terms-en_US-20240618.pdf |
| Signs individual DPAs with schools | not stated |
| UK GDPR representative / DPO | not stated |
| Minimum age | not stated |
| Key safety note | K-12 student data restricted to providing the service; school must configure under-13 access |
| Main use | Image generation |
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://helpx.adobe.com/firefly/get-set-up/learn-the-basics/adobe-firefly-faq.html · https://www.adobe.com/privacy/k12-student-page.html
Full entry: aiprefect.co.uk/tools/adobe-firefly. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.