Direct answer
Edves operates as a data processor under UK GDPR, is assessed against the DfE generative AI product safety standards, and supports KCSIE requirements on access control, logging and record separation.
The school or trust remains the data controller throughout, and pupil data is not used to train general-purpose AI models.
Data protection
- UK GDPR & data protection — controller and processor roles, DPAs and DPIAs, field-level access control, audit logging, retention, sub-processors, data ownership and exit.
Artificial intelligence
- DfE generative AI standards — what the standards require, how to use them in procurement, and how Edves is assessed against them.
Safeguarding
- KCSIE & safeguarding — what the 2026 edition changed, filtering and monitoring expectations, and how safeguarding records should sit in a school system.
The question to ask first
Ask any supplier whether they are the data controller or the data processor. Under UK GDPR the school is the controller and the supplier is the processor, and the school’s obligations to pupils and families do not transfer. A supplier claiming their compliance covers yours has either misunderstood the allocation or is hoping you have.
Related
AI in education sets out the policy timeline and an adoption sequence. Choosing school software lists the compliance questions to put to any supplier, including this one.