AI tool summary for DPOs and governors
D2L Brightspace (Lumi)
D2L · Facts last checked 2026-10-23 · Printed 23 October 2026
AI Prefect
Staff: Amber · Use with caution
- Doesn’t say where data is stored
- No school DPA found
- 4 of 6 key fields not stated
Pupils: Amber · Use with caution
- Doesn’t say where data is stored
- No school DPA found
- 4 of 6 key fields not stated
| Supplier | D2L |
|---|---|
| Category | LMS AI |
| Pupil-facing | yes |
| Processor or controller | processor (institution is controller) |
| Where data is stored | not stated |
| Trains AI models on inputs | no - customer data not used to train or fine-tune LLMs |
| How long inputs are kept | not stated |
| Data processing agreement (DPA) | not stated |
| Signs individual DPAs with schools | not stated |
| UK GDPR representative / DPO | not stated |
| Minimum age | not stated |
| Key safety note | not stated |
| Main use | VLE and learning platforms |
Better-rated alternatives for the same use: Aula (Amber)
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://community.d2l.com/brightspace/kb/articles/35008-d2l-lumi-faqs · https://www.d2l.com/legal/privacy-notice/
Full entry: aiprefect.co.uk/tools/d2l-brightspace. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.