What School Business Managers Should Never Put Into AI Tools

AI safety starts with knowing the boundaries. Before a school office team starts using AI tools more widely, the most important conversation is not about which tools to use — it is about what information should never go into them.

This guide covers the key red lines for school business managers and office teams.

Do not paste pupil personal data

Pupil names, dates of birth, addresses, school records, attendance information, exclusion details or anything that personally identifies a child should not be pasted into public AI tools.

Public AI tools — including ChatGPT, Claude and similar consumer products — process inputs on external servers. Even if you delete your prompt, data may be retained depending on the tool's privacy policy. This creates a data protection risk that is not acceptable for pupil information.

If you need AI to help with pupil-related documentation, work with anonymised examples or dummy data, and keep the real information separate.

Do not paste parent or carer information

Parent names, contact details, email addresses, household information or any communication records involving families should not go into public AI tools.

Parent data is personal data under UK GDPR. Schools have strict obligations around how it is stored, processed and shared. Pasting it into an external AI tool without appropriate controls is a potential compliance breach.

Do not paste staff HR information

Staff contracts, pay information, performance review notes, absence records, disciplinary information or anything related to an individual staff member's employment should not go into public AI tools.

HR data is among the most sensitive categories of personal data. Even partial or contextual information — descriptions of a situation involving a named or identifiable staff member — should not go into external tools.

Do not paste safeguarding notes

This is non-negotiable. Safeguarding information must not go into public AI tools under any circumstances.

Safeguarding records are among the most sensitive documents a school holds. They relate to children and families in vulnerable situations. There is no safe version of pasting safeguarding information into a consumer AI product.

Do not paste medical or SEND details

Medical information relating to pupils, SEND support plans, EHCPs, or health-related information about staff or families should not go into public AI tools.

Medical and health data is a special category of personal data with heightened protection requirements under UK GDPR. AI tools are not appropriate for processing this information.

Do not paste confidential finance or supplier data without proper controls

Financial forecasts, budget reports, payroll summaries, supplier contract terms or any commercially sensitive financial data should be handled with care.

If you need AI to help structure a report or draft a document involving financial data, use anonymised figures, percentage changes or general descriptions rather than the actual data.

Safer alternatives

The good news is that there is a lot AI can help with safely — when the approach is right.

Use anonymised examples: describe a situation without naming anyone or including identifying details.

Use dummy text: create a fictional version of a document to test structure and tone, then replace it with the real content yourself.

Use general scenarios: ask AI to help you draft a template or framework for a type of communication, without including any real data.

Use structure-only prompts: ask AI to give you an outline or checklist, then fill in the real detail yourself.

Use templates and repeatable formats: AI is very good at helping create frameworks, checklists and template documents that do not involve any personal data.

Human review remains essential

AI tools produce outputs. Those outputs need a human to check them before they go anywhere — to parents, staff, governors, suppliers or any other recipient.

AI can make mistakes. It can be confident and wrong. It does not understand the context of your school, your community or your specific situation. Human review is not optional.

What to do next

If your school office team is starting to use AI more widely, consider agreeing a simple set of boundaries before you begin. A short document covering what information stays out of AI tools, who reviews outputs, and how templates are stored can prevent problems before they happen.

Need practical support for your school office? View AI support for school business managers and find a safe, sensible place to start.

Frequently asked questions

What should schools not put into AI tools?

Pupil personal data, parent contact information, staff HR records, safeguarding notes, medical or SEND details and confidential finance data should not be pasted into public AI tools without appropriate controls.

Can school business managers use AI safely?

Yes. The key is knowing the red lines. AI works well for drafts, templates, checklists and structure — but the data that goes into it must be anonymised or generalised.

Is ChatGPT safe for schools to use?

Consumer versions of ChatGPT and similar tools are not designed for processing sensitive personal data. Schools should treat them as general writing and drafting tools, not as systems for handling personal or sensitive information.

What are safer ways for school offices to use AI?

Use anonymised examples, dummy text, general scenario descriptions and structure-only prompts. Keep real personal data out of the tool entirely and review all outputs before use.