AI tool summary for DPOs and governors
Turnitin (Feedback Studio / AI writing detection)
Turnitin · Facts last checked 2026-10-23 · Printed 23 October 2026
AI Prefect
Staff: Amber · Use with caution
- Data may be stored outside the UK/EU; safeguards not stated
Pupils: Amber · Use with caution
- Data may be stored outside the UK/EU; safeguards not stated
- Minimum age not stated
| Supplier | Turnitin |
|---|---|
| Category | AI detector / plagiarism |
| Pupil-facing | yes - students submit work |
| Processor or controller | processor (institution is controller) |
| Where data is stored | global environment (US/Canada); new UK Feedback Studio customers can choose EU (Frankfurt) storage; existing accounts cannot switch |
| Trains AI models on inputs | no generative model trained; YES - if AI detection is enabled, anonymised current student writing may be used to train the AI-detection classifier |
| How long inputs are kept | submissions may be kept indefinitely in Turnitin's repository unless the institution requests deletion |
| Data processing agreement (DPA) | https://www.turnitin.com/agreement.asp |
| Signs individual DPAs with schools | not stated |
| UK GDPR representative / DPO | not stated |
| Minimum age | not stated |
| Key safety note | AI-writing scores are a prediction, not proof; feedback summaries use Claude Haiku (Anthropic does not retain/train); video captions via Amazon Transcribe |
| Main use | Plagiarism and academic integrity |
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://www.turnitin.co.uk/trust-center · https://helpcenter.turnitin.com/hc/en-us/articles/49295931087373-Turnitin-Trust-Center · https://guides.turnitin.com/hc/en-us/articles/27377195682317-Turnitin-Services-Privacy-Policy · https://www.turnitin.co.uk/blog/turnitin-feedback-studio-regional-data-storage-now-available-in-the-eu-and-apac
Full entry: aiprefect.co.uk/tools/turnitin. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.