GDPR for AI Projects
We are introducing a number of AI-enhanced features to No More Marking over the next year that will reduce the amount of judging you need to do and enhance the feedback we can offer you. In order to provide these features we need to use an AI service to transcribe and process anonymised images of the pupils’ writing. We will select the providers carefully, and ensure that they neither retain data nor use the data to train their own models. Ideally we will process the data within the European Union, but where this is not possible we will use countries with a sufficient level of data protection as defined by the GDPR legislation. Our current providers, Anthropic and OpenAI, are based in the US and are noted in our AI GDPR agreement. Here is a link to the AI updated GDPR agreement.
These AI-enhanced features are optional and are turned off by default. You do not have to use them. If you do wish to use them, then under GDPR, you are accountable to the pupils and must inform parents of these changes. We have provided draft wording for your reference.
If you do wish to turn the AI-enhanced features on please see this help guide.
Purpose
Producing a summary of teachers’ audio comments made while judging to produce reports for pupils.
Transcribing anonymised images of writing so they can be assessed by an automated judging assistant.
Automated judging.
Privacy notice
https://www.anthropic.com/legal/privacy
How your data is used to improve model performance
We will not use your Inputs or Outputs to train our models, unless: (1) your conversations are flagged for Trust & Safety review (in which case we may use or analyze them to improve our ability to detect and enforce our Usage Policy, including training models for use by our Trust and Safety team, consistent with Anthropic’s safety mission), or (2) you’ve explicitly reported the materials to us (for example via our feedback mechanisms), or (3) you've otherwise explicitly opted in to the use of your Inputs and Outputs for training purposes.
Data retention
The data is deleted on the backend within 30 days of receipt or generation.
Data transfer
The data may be transferred to the Anthropic servers in the United States but Anthropic ensures it benefits from an adequate level of data protection by relying on Adequacy decisions and Standard contractual clauses.
Data storage
Data is stored within the US.
Purpose
Transcribing teacher's audio comments while judging.
Transcribing anonymised images of writing so they can be assessed by an automated judging assistant.
Automated judging.
Privacy statement
https://openai.com/enterprise-privacy/](https://openai.com/enterprise-privacy/](https://openai.com/enterprise-privacy/ *
How your data is used to improve model performance
https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance
Services for businesses, such as ChatGPT Team, ChatGPT Enterprise, and our API Platform
By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Team, ChatGPT Enterprise, and the API. We offer API customers a way to opt-in to share data with us, such as by providing feedback in the Playground, which we then use to improve our models. Unless they explicitly opt-in, organizations are opted out of data-sharing by default.
Data retention
OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them.
Data transfer
OpenAI encrypts all data at rest (AES-256) and in transit between our customers and us and between us and our service providers (TLS 1.2+), and uses strict access controls to limit who can access data.
Data residency
Data is stored within the US.
As you know we work with No More Marking who provide us with a robust method of moderating pupils’ writing. We are looking to improve the efficiency of how we implement No More Marking and in February we will be trialling an AI based method of speeding up the moderation process with No More Marking. The method requires us to share anonymised images of pupil writing from their national writing tasks that will be transcribed and shared with AI cloud services.
The data may be transferred to servers in the United States but we ensure it benefits from an adequate level of data protection by relying on Adequacy decisions and Standard contractual clauses. The data is deleted on the backend within 30 days of receipt or generation. The data is not used to train AI models. For further information please see the GDPR and privacy notice from No More Marking.
These AI-enhanced features are optional and are turned off by default. You do not have to use them. If you do wish to use them, then under GDPR, you are accountable to the pupils and must inform parents of these changes. We have provided draft wording for your reference.
If you do wish to turn the AI-enhanced features on please see this help guide.
The changes to our GDPR are summarised here:
Anthropic
Purpose
Producing a summary of teachers’ audio comments made while judging to produce reports for pupils.
Transcribing anonymised images of writing so they can be assessed by an automated judging assistant.
Automated judging.
Privacy notice
https://www.anthropic.com/legal/privacy
How your data is used to improve model performance
We will not use your Inputs or Outputs to train our models, unless: (1) your conversations are flagged for Trust & Safety review (in which case we may use or analyze them to improve our ability to detect and enforce our Usage Policy, including training models for use by our Trust and Safety team, consistent with Anthropic’s safety mission), or (2) you’ve explicitly reported the materials to us (for example via our feedback mechanisms), or (3) you've otherwise explicitly opted in to the use of your Inputs and Outputs for training purposes.
Data retention
The data is deleted on the backend within 30 days of receipt or generation.
Data transfer
The data may be transferred to the Anthropic servers in the United States but Anthropic ensures it benefits from an adequate level of data protection by relying on Adequacy decisions and Standard contractual clauses.
Data storage
Data is stored within the US.
Open AI
Purpose
Transcribing teacher's audio comments while judging.
Transcribing anonymised images of writing so they can be assessed by an automated judging assistant.
Automated judging.
Privacy statement
https://openai.com/enterprise-privacy/](https://openai.com/enterprise-privacy/](https://openai.com/enterprise-privacy/ *
How your data is used to improve model performance
https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance
Services for businesses, such as ChatGPT Team, ChatGPT Enterprise, and our API Platform
By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Team, ChatGPT Enterprise, and the API. We offer API customers a way to opt-in to share data with us, such as by providing feedback in the Playground, which we then use to improve our models. Unless they explicitly opt-in, organizations are opted out of data-sharing by default.
Data retention
OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them.
Data transfer
OpenAI encrypts all data at rest (AES-256) and in transit between our customers and us and between us and our service providers (TLS 1.2+), and uses strict access controls to limit who can access data.
Data residency
Data is stored within the US.
Draft for parents
As you know we work with No More Marking who provide us with a robust method of moderating pupils’ writing. We are looking to improve the efficiency of how we implement No More Marking and in February we will be trialling an AI based method of speeding up the moderation process with No More Marking. The method requires us to share anonymised images of pupil writing from their national writing tasks that will be transcribed and shared with AI cloud services.
The data may be transferred to servers in the United States but we ensure it benefits from an adequate level of data protection by relying on Adequacy decisions and Standard contractual clauses. The data is deleted on the backend within 30 days of receipt or generation. The data is not used to train AI models. For further information please see the GDPR and privacy notice from No More Marking.
Updated on: 14/04/2025
Thank you!