Using AI to make social stories safely: a school data-protection checklist

Yes, staff can try using AI for social stories, but only with tools your school has approved, with your DPO's advice, and with a teacher checking every line before a child sees it. This guide gives SENCOs, heads, DPOs and teachers a plain-English checklist: what counts as pupil personal data in a social story, why you should never upload a pupil's photo, the questions your DPO will ask, and how to keep a human in the loop. New to social stories? Start with our complete guide to social stories.

Why this matters now

AI tools are now easy to reach for in a busy school day, and the guidance is clear that pupil data needs protecting first.

The Department for Education's guidance on generative AI and data protection in schools asks schools to seek advice from their DPO and IT lead, use school-approved tools, protect personal data, make sure pupil data isn't used to train AI models, fact-check what AI produces and keep privacy notices up to date. Its wider guidance on generative AI in education makes the same point: AI can save staff time, but the school stays responsible for what goes in and what comes out.

In October 2026, safeguarding lead Shezleen Salaam wrote in Tes about the risks of AI photo apps and was clear: never upload children's photos to AI image apps. Social stories are a place where that temptation is real, because a picture of the child in their own classroom feels personal. There are safer ways to make a story feel personal, which we cover below.

What counts as pupil personal data in a social story?

A first name on its own may seem harmless, but a first name plus SEND context is personal data, and some of it may be special category data.

A social story is, by design, about one child and something they find hard. Put together, these details can identify a pupil and reveal sensitive information:

• their name (first name, surname or nickname)
• their class, year group, school or teacher's name
• a diagnosis, EHCP details or health information
• what they find difficult, how they react, and any incidents
• their photo, or photos of their home or family

Health information, including a diagnosis, is usually treated as special category data under UK GDPR and needs extra care. Your DPO can confirm how your school classifies it. Even without a diagnosis, "Leo in 3B gets upset when the fire alarm rings" tells a reader something sensitive about an identifiable child. Treat anything you type into an AI tool as if it could be read by someone outside school, unless your DPO has confirmed otherwise.

The checklist: before you use any AI tool for a social story

Run through these questions before any pupil detail goes into a chatbot, a generator or an app.

• Is the tool school-approved? It's on your school or trust's list of approved tools, not a personal account.
• Has your DPO been asked? Your DPO (and IT lead) know which tool you're using and for what.
• Is pupil data used to train the AI? No. Your school's settings or contract confirm inputs aren't used for training.
• Are photos involved? No pupil photos are uploaded, ever.
• Have you removed surnames and identifying detail? Only a first name or a placeholder like "[Child]"; no class, school or family names.
• Is there any special category data? No diagnoses, EHCP details or health information typed in.
• Where is the data processed and stored? You (or your DPO) know which countries, and for how long.
• Will a member of staff check every line? Yes. Nothing goes to a child without a teacher reading and editing it.
• Is it covered in your privacy notice? Your DPO has checked whether the privacy notice needs updating.

If you can't answer "yes" to the first three, stop and talk to your DPO before you go further.

Can staff use ChatGPT, Copilot or free story generators?

It depends on your school's rules, not on the tool. Some schools and trusts have approved a particular AI tool with settings agreed by their DPO; others haven't approved any. A free generator on a personal account is very unlikely to meet the DfE checklist above. If your school hasn't approved a tool, you can still use AI for general ideas with no pupil information at all (for example, "a short story for a seven-year-old about a fire drill"), then personalise it yourself afterwards, offline. Check your school's AI policy first.

Never upload pupil photos

Don't upload photos of pupils to any AI tool, including to turn them into cartoons or avatars.

This is the clearest rule in this guide. A child's photo is personal data, it can identify them anywhere, and once it's in an AI image app you may not control where it goes or how long it's kept. The Tes article sets out the safeguarding risks.

You don't need a photo to make a story feel like it belongs to the child. Illustrations, symbols, or photos of places with no people in them (the hall, the lunch queue, the classroom door) work well. Our guide to writing a social story covers choosing pictures.

Writing safely: placeholders, less detail, a human check

Give the AI as little about the child as possible, then make the story personal yourself.

• Use placeholders. Write "[Child]" and "[Teacher]" instead of real names, and fill them in after the draft is done.
• Strip identifying detail. Leave out surnames, class names, the school's name, family names and anything about a diagnosis.
• Describe the situation, not the child. "A child who finds the noise of the fire alarm hard" is enough for a draft.
• Read and edit every line. AI can get facts wrong, use the wrong tone, or add instructions the child doesn't need. Check it matches what really happens in your school.
• Describe more than you direct. A good social story mostly explains what happens and how people feel, with few "I can try" sentences. AI drafts often tip into telling the child what to do, so edit those back. Our how-to guide explains sentence types.

A human check isn't a formality. You know the child, the routine and the words that might worry them. The AI doesn't.

Questions your DPO will ask

Expect these questions, especially if the tool is new to your school; it helps to have the answers ready.

• What personal data goes in? Names, photos, SEND information, free-text notes.
• Who is the controller and who is the processor? Usually the school is the controller; the supplier processes data on the school's instructions.
• Which other companies (sub-processors) handle the data? A list of AI providers and hosting companies.
• Where is data processed and stored, and for how long? Countries (UK, EU, USA?) and retention periods.
• Is pupil data used to train AI models? It should not be.
• Is the supplier registered with the ICO? A registration number you can check.
• Who uses the tool: staff or pupils? Whether pupils interact with the AI directly.
• Do we need a DPIA or a privacy notice update? Your DPO decides; have the answers above ready.

A supplier that publishes clear answers to these questions saves everyone time.

How ReadyStories approaches this

ReadyStories is a staff-facing way of using AI for social stories without uploading pupil photos — and you can review and edit every story. Inspired by Carol Gray's Social Stories™ approach; pupils don't chat with the AI.

From our data and safeguarding page and privacy notice: no photo uploads (illustrated avatars); first name or nickname only; names known to the app are replaced with placeholders before AI (don't type surnames or sensitive details into notes); pupil and story data stored in the EU (Ireland); some AI processing via Gemini/OpenRouter in the USA (Google AI Studio may keep image requests up to 55 days); your school is the controller; ICO ZC282126. Share those pages with your DPO. Social stories are a communication and teaching support, not a treatment.

Join our founding schools.

FAQs

Can teachers use ChatGPT to write social stories?

Only if your school has approved it and your DPO is happy with how it's set up. If not, use it only for general ideas with no pupil information, and personalise the story yourself.

Is a pupil's first name personal data?

Yes. A first name together with SEND context, a class or a school can identify a child, so treat it as personal data.

Can I turn a pupil's photo into a cartoon with an AI app?

No. Don't upload pupil photos to AI image apps. Use illustrations, symbols or photos of places without people instead.

Do we need a DPIA to use AI for social stories?

Your DPO decides. Tools that process pupil information, especially SEND-related information, may need a DPIA. Have the answers to the DPO questions above ready.

Does ReadyStories send pupil names to the AI?

Names known to the app are replaced with placeholders before AI processing. Free-text notes can still include names, so staff shouldn't type surnames or sensitive details there.

Where is ReadyStories data stored?

Pupil and story data is stored in the EU (Ireland). Some AI processing happens in the USA. Full details are on our privacy notice.

Does AI replace the teacher in writing a social story?

No. AI can speed up a first draft, but a member of staff who knows the child should check and edit every line.

In short

You can use AI to help make social stories, as long as your school has approved the tool, your DPO knows about it, no pupil photos are uploaded, identifying detail stays out, and a teacher checks every line. Use the checklist above before any pupil detail goes into a tool.

Want a staff-facing tool built around these rules? Join our founding schools. Looking for something simple to start with? Get the free Tricky Moments Calendar.