The promise sounds irresistible: a platform that knows how each student learns, which mistakes they repeat, how long each exercise takes and what they should study tomorrow. To achieve it, it needs data: grades, attendance, timings, errors, sometimes behavior, sometimes voice or face. The question is no longer just whether AI personalizes, but how much of children's data we are willing to hand over in exchange.
In this article I review which data are handled, what Colombian law and international regulation say, what happened in one of the largest school data incidents, and give you ten criteria to use educational data responsibly, useful for teachers, school leaders and families. Rules and cases checked on October 9, 2026. This is guidance, not legal advice.
Summary. In Colombia, Law 1581 of 2012 restricts the processing of minors' data to public data and requires their best interests to prevail; SIC External Circular 002 of 2024 asks AI systems to meet suitability, necessity, reasonableness and proportionality, with a prior impact assessment. The practical rule: collect less data, with a clear purpose, with human oversight and with a provider you can audit.
Which data are collected and which are sensitive
Not all of a student's data weigh the same. This practical classification helps decide how much care each type deserves:
One category deserves a warning: inferences. When an AI calculates that a student "is at risk of dropping out", "is unmotivated" or "has a visual learning style", it creates new data about the child that can be wrong and that, once in a profile, tends to follow them. And health, disability or diagnosis data (for example, from a support plan) are sensitive: they should not reach an external tool with first and last names.
A real case: the PowerSchool breach
At the end of 2024, the US platform PowerSchool, which manages student information in thousands of schools, suffered unauthorized access. According to Tom's Guide's summary based on BleepingComputer, the data of about 62.4 million students and 9.5 million teachers were affected, and the intrusion used a contractor's credentials, not a ransomware attack or a software flaw. What was exposed depended on each district: names, addresses, phone numbers, grade point averages, parent information and, in some cases, medical data. Figures vary by source and some details (for example, the exposure of Social Security numbers) conflict between reports. The lesson is simple: the more data a provider concentrates, the more attractive and damaging an incident is, and a school's security also depends on its contractors' credentials.
What the law says: Colombia, Latin America and the world
In Colombia several rules combine. Article 7 of Law 1581 of 2012 establishes that in processing the data of children and adolescents their rights must prevail and that processing their data is prohibited, except for data of a public nature; it also assigns educational institutions the duty to inform and train legal representatives and guardians about the risks of misuse. The Constitutional Court (Ruling C-748 of 2011) clarified that it is not an absolute ban: there can be processing when it respects the minor's best interests. Decree 1074 of 2015 (which compiled Decree 1377 of 2013) also requires that respect for their fundamental rights be ensured and that the legal representative authorize, after hearing the minor's opinion according to their maturity. A school acts as the data controller.
For AI, SIC External Circular 002 of 2024 applies Law 1581 to data processing in artificial intelligence systems: it demands suitability, necessity, reasonableness and proportionality, risk management, a privacy impact study before design and development and the ability to demonstrate compliance (demonstrated accountability). According to commentators, it also promotes privacy by design and by default.
Worldwide, the European Union went further: its AI Act has banned inferring people's emotions in educational institutions since February 2025 (except for medical or safety reasons) and classifies as high-risk the AI systems that determine access to educational institutions, evaluate learning outcomes or monitor behavior during exams; the timeline for high-risk obligations has been adjusted, so verify the current date. In Latin America, data protection laws vary in maturity, but the trend is the same: processing minors' data demands more care, and the region's schools and platforms often operate with global providers without families or teachers knowing where the data live. That information asymmetry is part of the problem.
Ten criteria for responsible use of educational data
This is the practical resource. Use it to evaluate a platform or an institutional policy:
| Criterion | Key question | Warning sign |
|---|---|---|
| 1. Purpose | Which specific pedagogical decision does this data improve? | "In case it is useful later". |
| 2. Necessity (minimization) | Can the same be achieved with less data or anonymized data? | They ask for more data than needed. |
| 3. Proportionality | Does the benefit justify the risk to a minor? | Biometric or emotional data for simple tasks. |
| 4. Authorization and information | Do families understand which data, what for and who sees them? Was the student heard according to maturity? | A generic consent buried in enrollment. |
| 5. Human oversight | Does a teacher review before a profile or alert affects the student? | Automatic decisions on grades, groups or sanctions. |
| 6. Provider and contract | Where is the data stored, who accesses it and is it used to train models? | Clauses allowing reuse of the data. |
| 7. Security | Are there access controls, encryption, access logs and MFA, including for contractors? | Shared accounts without a second factor. |
| 8. Retention and deletion | How long is it kept and how is it erased? | No time limit or deletion procedure. |
| 9. Rights and channels | Can families consult, correct and request deletion of the data? | No channel or visible person in charge. |
| 10. Impact assessment and incidents | Was an impact study done before using it and is there a plan for a breach? | "Nothing has ever happened to us". |
And a three-question test that fits in any academic council meeting: 1) Which pedagogical decision does it improve? 2) Could it be achieved with less data? 3) What happens if it leaks or gets it wrong? If there is no good answer to all three, the data probably should not be collected.
Four viewpoints: teachers, families, students and providers
- Teachers: they want tools that save time, but they are the ones who upload the data and answer to families. They need clear rules on what they can and cannot upload to an AI platform.
- Families: they almost never know which platforms the school uses or what data they hand over. They have the right to ask and to get an understandable answer.
- Students: they have the right to be heard and not to carry labels an algorithm gave them at 12.
- Providers: a good provider can explain which data it collects, why, where it stores them and how they are erased. If it cannot, that is a signal.
How I apply it in my tools
I apply what I recommend: in PIAR con IA and the AI Exam Generator, what you type is sent to the Google Gemini API to generate the document, which is why I recommend using initials and not including data that identifies students; the site's privacy policy explains it. The support plan handles sensitive information (disability, supports), so that precaution is not a detail: it is the rule. If you want to work on a reasonable-accommodations plan without exposing a student, start with the PIAR con IA package using minimal data, and to assess without collecting profiles, the AI Exam Generator creates exams and solutions without needing students' personal data (there is a free demo). The AI Kit for teachers includes a digital citizenship sequence (footprint, privacy and personal data) to work on this topic with your students.
To keep reading: basic security mistakes, AI agents with access to your systems and whether AI expands student thinking or replaces it.
Frequently asked questions
Can a school use student data on an AI platform?
It can, if it complies with Law 1581 of 2012: a legitimate purpose, information and authorization from legal representatives, prevalence of the minor's best interests, security measures and, for AI, the guidelines of SIC Circular 002 of 2024. Some data are better not shared with an external provider.
What is sensitive data and why does it matter?
It is data that affects privacy or whose misuse can generate discrimination (health, biometric data, racial origin, among others). Its processing requires stricter conditions. In a school, disability data, diagnoses and supports are the clearest example.
What happens if a school platform suffers a breach?
The controller must report the incident under SIC rules (several firms indicate a 15-business-day deadline from detection; confirm the current text) and inform those affected. That is why a response plan is needed before it happens.
Can learning be personalized without collecting so much data?
Yes. Many useful personalizations (exercises at different levels, feedback, reinforcement paths) work with minimal or anonymized data. More data does not always mean better learning.
What do I ask the school as a parent?
Which platforms they use, which data of my child they collect, what for, who has access, where it is stored, for how long and how I can correct it or ask for it to be deleted.
Review your policy this week. Apply the ten criteria to a platform you use at your school and ask: do we have a written privacy and AI-use policy? If not, propose one at the academic council. And if you work with reasonable-accommodation plans, protect the data with PIAR con IA using initials.
Food for thought
A child cannot decide whether they want the school to keep every mistake they make on a platform that will accompany them for years. If personalization requires closely watching students, does the learning we gain justify the privacy we take away, and who should have the last word: the school, families or the students themselves when they grow up and read their file?
Was this article helpful?
React and share it with someone who might find it useful.
- Like 0
- Insightful 0
- Celebrate 0
- Love 0
- Thought-provoking 0
Prefer to have it ready?
More guides in AI and technology for teachers