Is AI Marking GDPR Compliant? What Schools Need to Know Before Using Ariel

In 2026, the regulatory environment around AI in schools is moving fast. Ofqual published a working paper on AI marking in January. The DfE updated its guidance on AI in education. Schools are being asked to think carefully about what tools they use, on what basis, and with whose data.

That scrutiny is right. Student data deserves it.

But it also means that teachers who want to use AI marking — and have good reason to — sometimes find themselves stuck waiting for a data lead to sign something off, or an SLT who isn't sure what questions to ask. This post is for them. It covers exactly what Ariel does with student data, in plain language, so that the compliance conversation can happen quickly and on the right terms.

Student data stays in the UK

All student data processed by Ariel is stored in the UK — Supabase's London data centre for the database, Vercel's London region for hosting. Student essays, marks, and feedback never leave UK infrastructure.

Ariel Education Ltd is registered with the Information Commissioner's Office, registration number ZC153061.

The school controls the data. Ariel processes it.

Under UK GDPR, the school is the data controller and Ariel is the data processor. This is the correct relationship for a tool that handles student data on a school's behalf — the school determines the purpose; Ariel carries out the processing under the school's instructions.

Before any student data is uploaded, schools sign a Data Processing Agreement with Ariel. This sets out what data is processed, for what purpose, and what both parties are responsible for. A standard DPA is available on request — email [email protected] and it comes back within one working day.

Student essays are never used to train AI

This is the question most schools ask first, and the answer is unambiguous: no.

Student essays are never used to train or improve any AI model. This is written into Ariel's terms of service and enforced in the code. Before any essay text reaches the AI for marking, Ariel's anonymisation layer strips student names, teacher names, school names, email addresses, phone numbers and postcodes — replacing each with an anonymised placeholder. A separate check runs immediately before every AI call and cancels it if any identifiable information remains.

The AI receives anonymised text only. It never sees a student's name.

Who can see student data

Access is restricted by role and enforced at the database level — not just in the application interface.

Student data is visible only to the student themselves, their class teacher, and the Head of Department at the same school. A teacher at one school cannot see data from another school — this is technically impossible, enforced through security controls on every database table.

The third-party processors Ariel uses

Ariel uses a small number of sub-processors, all under data processing agreements:

• Supabase — database and file storage, UK London region
• Vercel — platform hosting, UK London region
• Anthropic — AI marking engine, USA. Anonymised essay text only, no student names or identifiers. Retained for 7 days then deleted; not used for model training. Covered by EU Standard Contractual Clauses and UK International Data Transfer Addendum.
• Resend — email delivery. Teacher name and email address only — no student data.
• Sentry — error monitoring, EU region. Personal data suppressed before logging.

Student essay content reaches only Supabase (storage) and Anthropic (marking). Anthropic receives anonymised text only.

How data is encrypted and retained

All data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). Security headers including Content Security Policy are enforced on every response.

Under Ariel's retention schedule: student rosters and essays are held for the duration of the subscription plus 30 days; account data for 30 days after closure; server logs for 90 days; audit logs for 12 months. Schools can request deletion of their data at any time via the data deletion page.

What Ariel does not do

• Does not use student essays to train AI models
• Does not store student data outside the UK
• Does not serve advertising or use student data for any commercial purpose beyond the marking service
• Does not allow cross-school data access
• Does not use non-essential cookies — there is no cookie consent banner because none is needed

What schools need before uploading student work

Two things:

1. A signed Data Processing Agreement between the school and Ariel Education Ltd — available from [email protected], typically returned within one working day.
2. Confirmation that the school's privacy notice covers the use of third-party processors for assessment purposes. Most school privacy notices already include this, but it is worth a quick check with your data lead.

That's the compliance picture. If your data lead or SLT has questions beyond what's here, email [email protected] directly. If you're also evaluating how accurate Ariel's marking is before committing, the methodology is explained in full at How accurate is AI marking for GCSE English?.

Frequently asked questions about AI marking and GDPR