In the second of a five-part series on AI in education, data protection expert Craig Stilwell outlines how schools and trusts can tackle the deluge of AI-generated data requests.
How would you feel if a densely worded 35-page subject access request appeared in your inbox?
One school we’ve worked with did indeed have that surprise waiting for them one morning last year.
Your first thought might be to wonder who could possibly have the time to devote to a communication rivalling a degree dissertation in length, closely followed by a strong suspicion that the technological good fairy (or malign nemesis, depending on your view) called generative AI had a major part to play.
It’s an extreme example but highlights the boom in AI generated data requests, including subject access requests (SARs), we’ve seen over the last 12 months.
It is hard to accurately quantify the increase because it’s sometimes difficult to determine if a request is entirely generated through AI, or if AI was used to help as a supportive tool in an attempt to create a more cohesive, clearer request.
When we surveyed our schools 80% confirmed an increase in requests they say were generated with AI help, with 30% also experiencing a significant overall jump in data requests.
It isn’t just the volume; schools are finding it hard to keep up with the content of those requests. They don’t always run to 35 pages, of course, but they can contain a lot more detail that needs to be reviewed and responded to. Often they come with arbitrary, unachievable deadlines. And they can be challenging in tone.
Spotting AI-Generated SARs
Spotting AI-generated SARs isn’t an exact science – after all, generative AI has the capability of producing slick text precisely because it feeds on human produced content – but there are tells. These include detailed references to laws or irrelevant content, heavy use of formatting including lots of bold text and bullet points, and a liberal sprinkling of US spellings such as labor instead of labour.
The fact that AI plays a major role in these requests creates a set of challenges that make your job of responding that bit harder.
A fundamental issue is that while the ‘writer’ thinks AI has done all the hard yards in making their request as clear as possible, the result frequently falls far short and requires extra time from you and your colleagues to understand the precise nature of the request.
As AI output is based on the user’s prompts the output is only as good as those prompts. Incorrect facts or misunderstandings will almost certainly lead to factual inaccuracies.
AI can also over complicate an issue. Depending on the prompt, the technology can miss important nuances or produce responses that are unnecessarily complex, presenting an issue as more serious than it is. This can make it harder for the user to accept an outcome as reasonable or proportionate, and likely lead to more resource-hungry appeals and back and forths.
AI has a chilling effect on the tone of communications as well. Many AI-assisted SARs are beginning to shift away from the actual purpose of a subject access request – to get access to information – and resemble complaints with a more assertive and demanding flavour. This can be the result of the tone of the language used in the AI prompts and can lead to a situation in which any response from the school, however helpful in intention, cannot hope to meet the expectations set out in the SAR.
Tackling the Challenge
Luckily, schools and trusts aren’t on their own. The 2025 Data Use and Access Act introduced an updated expectation to only need to make reasonable and proportionate searches when a requester asks for their data. This means when requests are either unclear or ask for “everything” when it’s hard to decipher what this means, you can just carry out reasonable searches instead.
There is a ‘but’. From 19 June 2026, the legislation requires all organisations to have a process for managing data complaints so that individuals can submit a complaint if they are unhappy with how their data, or their request for data, is handled. Given that AI requests are starting to take the form of complaints, this could trigger a rise in complaints and SARs.
In the meantime, your school or trust doesn’t have to tolerate devoting excessive staff time in dealing with these requests and should take steps to take control from the outset.
If it is clear AI is used to generate a request, it’s important to understand this early. As part of this discussion you can:
Educate users about the dangers of using AI for completing forms and complaints (such as unrealistic expectations, questions you cannot answer or inaccuracies).
Explain why it is important to hear from them in their own words and suggest a live discussion either in person or over the phone to understand what they want.
Set out what the implications are if they do continue to use AI to continue with their correspondence, namely that it could lead to delays or even incomplete responses if steps are needed to clarify the request.
Make them aware you can only respond to areas within your limit, explaining where and why you cannot assist.
If the correspondent continues to escalate and challenge and you cannot investigate further, close the conversation down using the appropriate mechanisms available to you.
Craig Stilwell is Head of Data Services at Judicium Education, a professional services company working with more than 1,700 schools across England. Judicium Education advises on health and safety, HR, legal services, clerking, governance and data protection. For training and advice on AI go to www.judiciumeducation.co.uk/training/dpo-Artificial-Intelligence-in-Education
A version of this article originally appeared in SecEd and Headteacher Update.
