Is AI Speaking Practice GDPR-Compliant for Schools? What to Ask Before You Approve One

Whether an AI speaking tool is safe to use under UK GDPR comes down to what happens to pupils' voices, transcripts and accounts. Before approving one, a school's DPO should get clear answers to the questions below. Each comes with what a good answer looks like.

The questions to ask

1. Is the provider registered with the ICO? A good answer gives a registration number you can check on the ICO's public register.
2. Has it carried out a DPIA? Processing children's voices with AI calls for one (see the ICO's guidance on when a DPIA is needed). A good answer is yes, with the main risks and how they're handled.
3. Is there a data processing agreement for schools? A good answer is a published DPA you can read before signing anything.
4. What personal data does it collect? A good answer is a short, specific list, with no card details held by the provider itself.
5. Are sessions recorded, and for how long? A good answer says plainly whether audio is kept, by whom, for how long and for what purpose.
6. Is pupils' data used to train AI models? A good answer is a clear no that covers the provider's AI suppliers too.
7. Who are the sub-processors? A good answer names every one.
8. Can a teacher's access to a pupil's work be removed? A good answer is yes, from inside the product, straight away.
9. Can a pupil's data be deleted? A good answer covers both a pupil deleting their own account and the school asking for deletion.

How Tête-à-Tête answers

• ICO: registered, number ZC135288.
• DPIA: a full data protection impact assessment, available on request.
• Agreements: a published Data Processing Agreement, School Addendum and schools privacy notice.
• Data collected: account details (email, name, year group, exam board, tier and language, and the school: required for teachers, optional for pupils), consent records, sign-in security logs, session transcripts and scores, in-app usage events, app notification tokens and payment references. No card numbers reach our servers.
• Recordings: "Every session is recorded by our infrastructure provider and automatically deleted after 30 days. We use it only to diagnose faults in the AI examiner — never to train AI models. Recordings are never stored on Tête-à-Tête's own systems and can't be played back in the app."
• AI training: transcripts and scores are not used to train AI models.
• Sub-processors: all named in our privacy policy.
• Teacher access: ends when a teacher removes a pupil or archives the class.
• Deletion: a pupil can delete their own account at any time. A school can ask us to delete its pupils' data at any time, and when the service ends we delete all personal data within 90 days unless the law requires us to keep it, as set out in our Data Processing Agreement.

Need anything else for your review? Email hello@tete-a-tete.ai.