AI tool summary for DPOs and governors
ChatGPT Edu
OpenAI · Facts last checked 2026-10-23 · Printed 23 October 2026
AI Prefect
Staff: Green · Lower risk: fine to use with normal checks
- Processor, no training on inputs, UK/EU storage or stated transfer safeguards, school DPA available
Pupils: Amber · Use with caution
- Minimum age not stated
| Supplier | OpenAI |
|---|---|
| Category | general chatbot |
| Pupil-facing | not stated |
| Processor or controller | processor (OpenAI Data Processing Addendum s.1.1) |
| Where data is stored | UK data processed by OpenAI OpCo, LLC (US) under the SCCs with the UK Addendum (DPA s.4.2); storage region not stated |
| Trains AI models on inputs | no by default unless explicitly opted in |
| How long inputs are kept | not stated |
| Data processing agreement (DPA) | https://openai.com/policies/data-processing-addendum/ |
| Signs individual DPAs with schools | yes - DPA forms part of the OpenAI Services Agreement |
| UK GDPR representative / DPO | not stated |
| Minimum age | not stated |
| Key safety note | not stated |
| Main use | General AI assistant / chatbot |
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://openai.com/enterprise-privacy/ · https://openai.com/policies/data-processing-addendum/
Full entry: aiprefect.co.uk/tools/chatgpt-edu. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.