# Are AI detectors allowed under GDPR when the school runs student essays through a US company? Source: https://global100.org/forum/q/are-ai-detectors-allowed-under-gdpr-when-the-school-runs-student/ Site: Global 100 Forum, category Policy, law and disclosure Published: 2026-10-30. Updated: 2026-11-01. Replies: 7. ## Question by Kwame A., 2026-10-30 I study law at a university in the EU and I am writing a short paper on automated detection in education. The case I keep coming back to is simple. A university uploads student essays, with names or student numbers attached, to an AI text detector run by a company based in the United States. The student was not asked and cannot opt out. The lecturer then sees a score. My question is about the data protection side rather than the accuracy side. I can see several issues: whether an essay with an identifier is personal data at all, what the lawful basis would be, whether the vendor is a processor or something more, what happens to the text after the check, and whether sending it to the US needs a specific mechanism. I also wonder whether the right not to be subject to a decision based solely on automated processing matters here, or whether a human reading the score is enough to avoid it. I do not want legal advice for a specific institution. I would like to know how a data protection officer would actually approach this, and which parts of the regulation to read first. If anyone has been through a procurement or an impact assessment for one of these tools, even better. ## Reply 1 by Tobias K., 2026-10-30 I have sat in the room when this was discussed at our institution, and the first thing that happened was that someone asked whether the vendor was on the approved supplier list. It was not. The tool had been enabled through a platform integration, and nobody in the data protection office had seen the contract. That is common. The discovery is often that the tool arrived as a feature of something already approved, and nobody reviewed the new feature at all. So for a paper, I would describe the procedural failure as much as the legal one: who signed off, on what record, and when. ## Reply 2 by Ingrid V., 2026-10-30 Practical shortcut that gets used in industry: strip the name and student number before the upload and the text becomes anonymous, so GDPR no longer applies. Most vendors support sending just the body text. If you want to keep this simple, that is the answer. No identifier, no personal data, no problem. ## Reply 3 by Sam Whitlock, 2026-11-01 Careful with that, Ingrid. Removing the header is pseudonymisation at best, and often not even that. The system still has to hand a score back to the right student, so a mapping exists somewhere, in the learning platform or in a job ID the vendor logs. And an essay about a student's own placement, family, or health is identifying from the content alone. "We removed the name field" is the weakest form of the argument, and a regulator would treat it that way. It reduces risk. It does not make the processing disappear. ## Reply 4 by Aisha R., 2026-11-01 From the student side: I was never told. I found out which tool my university used because a lecturer mentioned it in passing. There was a line in a long handbook about "plagiarism detection software", but nothing said that a US company would receive my essay, how long they keep it, or whether it would be used for anything else. If I had been asked, I do not think I would have objected, but I would have liked to be asked. ## Reply 5 by Ingrid V., 2026-11-01 @Sam Whitlock fair, I was too glib. In my work we do separate the two but I stated it as if the removal ended the question. A mapping exists the moment a score has to come back to a person. I will stop calling it anonymous. ## Reply 6 by Maya Lindqvist (staff), 2026-11-01 It can be lawful, but not automatically. Student essays usually contain personal data, so the school needs a lawful basis, a written processor contract that limits what the vendor may do with the text, and a valid route for the transfer to the US. A data protection officer should be able to show all three in writing. Two articles are the best place to start. [Article 28](https://gdpr-info.eu/art-28-gdpr/) governs processors. The controller may use only processors that give sufficient guarantees, and the processing must be governed by a binding contract. That contract must say the processor handles the data only on documented instructions from the controller, including about transfers to a third country, deletes or returns the data when the service ends, makes available what is needed to show compliance, and allows audits. Subprocessors need the controller's authorisation and the same obligations. One more line matters for detectors: a processor that decides its own purposes and means for the data, for example by keeping essays to improve its models, is treated as a controller for that processing. So ask the vendor, in the contract, whether submitted text is retained or reused. [Article 44](https://gdpr-info.eu/art-44-gdpr/) opens the chapter on transfers. A transfer to a third country may take place only if the conditions in that chapter are met, and the level of protection guaranteed by the regulation must not be undermined. The chapter's later articles cover adequacy decisions, appropriate safeguards and narrow derogations, so ask which one the vendor relies on and check that it is current for that company, since this is the part that changes. Neither article tells you the lawful basis for scanning essays. That is a separate question, and for students it needs a written answer, as does transparency toward them. For your paper, the useful finding is that "a human reads the score" does not remove any of this. ## Reply 7 by Kwame A., 2026-11-01 @Maya Lindqvist thank you, that is the structure I was missing. I had treated the transfer question as the whole issue, but the point about a processor becoming a controller if it reuses the text for its own purposes is the one that changes the analysis. I will ask what the contracts of the usual vendors say about retention rather than guess. --- Cite as: Global 100 Forum, "Are AI detectors allowed under GDPR when the school runs student essays through a US company?", https://global100.org/forum/q/are-ai-detectors-allowed-under-gdpr-when-the-school-runs-student/, accessed 2026-11-10.