AI tool summary for DPOs and governors
Canva (Education / Magic Studio)
Canva · Facts last checked 2026-10-23 · Printed 23 October 2026
AI Prefect
Staff: Green · Lower risk: fine to use with normal checks
- Processor, no training on inputs, UK/EU storage or stated transfer safeguards, school DPA available
Pupils: Amber · Use with caution
- Minimum age under-13s only via school-managed accounts (no self-registration): not for younger pupils; check consent
| Supplier | Canva |
|---|---|
| Category | design |
| Pupil-facing | yes |
| Processor or controller | processor where Canva's Data Processing Addendum applies (customer is controller) |
| Where data is stored | region not stated; restricted transfers under SCCs with the UK Addendum (DPA s.2.4) |
| Trains AI models on inputs | no - Canva Education user content not used for AI training; AI partners may not retain or train |
| How long inputs are kept | deleted on request, recovery windows for deleted designs (no period) |
| Data processing agreement (DPA) | https://www.canva.com/policies/data-processing-addendum/ |
| Signs individual DPAs with schools | not stated |
| UK GDPR representative / DPO | not stated |
| Minimum age | under-13s only via school-managed accounts (no self-registration) |
| Key safety note | consumer Canva DOES train on data by default (opt-out); Education terms differ |
| Main use | Graphic design |
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://www.canva.com/education/schools/student-safety/ · https://www.canva.com/policies/privacy-policy/ · https://www.canva.com/policies/data-processing-addendum/
Full entry: aiprefect.co.uk/tools/canva. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.