Choose an AI marking tool that stores and processes student data in Australia, complies with the Privacy Act 1988 and its Australian Privacy Principles, and never reuses student work to train its models. Ask vendors about data residency, sub-processors, deletion, breach notification and independent security assessment before you buy.
Which Australian privacy laws apply to an AI marking tool?
Any AI marking tool that handles student work must comply with the federal Privacy Act 1988 and its 13 Australian Privacy Principles (APPs), which govern how personal information is collected, used, stored and disclosed. The Office of the Australian Information Commissioner (OAIC) regulates these principles and the Notifiable Data Breaches scheme. Student names, submissions and results are all personal information, so an AI marking tool sits squarely inside this framework from the moment a class is uploaded.
Government schools also answer to state and territory rules and to their own department’s data policies. New South Wales has the Privacy and Personal Information Protection Act, Victoria has the Privacy and Data Protection Act 2014, and most departments publish approved-supplier or data-handling requirements a vendor must satisfy. Confirm which of these apply to your setting before you buy, because a tool that meets the national baseline can still fall short of a department contract, and it is the school that carries the obligation, not the software.
Does student data have to be stored in Australia?
Not always, but Australian data residency is the safest default and is frequently required by contract. The Privacy Act does not ban offshore storage outright; instead, APP 8 makes your school accountable for what happens when a vendor discloses personal information to an overseas recipient. In practice, many education departments and procurement templates require that student data be stored and processed onshore, in Australian data centres, which removes a large area of doubt.
Data residency is also different from data sovereignty. Residency is where the data physically sits; sovereignty is whose laws can compel access to it. A vendor might store data in Sydney yet route processing through an overseas parent company or a foreign cloud region, exposing it to another country’s legal reach. Ask for a written map of every location where student data is stored, processed and backed up, along with every sub-processor involved, so nothing crosses a border you did not expect.
How can you check whether a vendor trains its AI on student work?
Ask the vendor directly, in writing, whether student submissions are used to train or fine-tune its models, and require a contractual commitment that they are not. Australian privacy law expects personal information to be used only for the purpose it was collected, so reusing student work to improve a commercial model can breach that purpose-limitation expectation and quickly erode the trust of students and families.
Look past marketing language for specifics. A privacy-conscious vendor will tell you which AI provider it relies on, whether prompts and responses are retained, how long data is kept, and whether any content leaves its controlled environment. Tools that keep a human — the teacher — reviewing and approving every piece of feedback also reduce risk, because the AI drafts rather than decides.
Consistency matters too. A good tool applies your rubric, success criteria and comment banks the same way across a whole class, which is a genuine benefit of automation, while still leaving the final judgement with the teacher who knows the students.
What should a school's buying process look like?
Treat an AI marking tool like any other data-processing supplier and run a short privacy assessment before you sign. Involve your IT or privacy lead, not only the teaching team, and document what personal information the tool collects, why it needs it, where the data flows and how it is deleted. This mirrors a privacy impact assessment and gives you evidence of due diligence if a parent or regulator ever asks how the decision was made.
You can lighten the load by preferring products that have already been independently assessed. Safer Technologies 4 Schools (ST4S), a national initiative supported by state and territory education departments, evaluates digital products against a shared privacy and security framework, so a tool that has been through it has already answered many of the questions on your checklist.
- Map the data: what is collected, who can see it, and where it is stored.
- Confirm Australian data residency and list every overseas sub-processor.
- Get a written 'no training on student data' commitment.
- Check the deletion, export and retention terms.
- Ask for evidence of independent assessment such as ST4S.
What are the red flags that a tool is not privacy-safe?
The clearest warning sign is a vendor that cannot tell you where student data is stored or which third parties process it. Vague answers, a privacy policy written only for a general consumer audience, or reluctance to sign your department’s data agreement all suggest the product was not built with school data obligations in mind.
Other red flags are subtler. Watch for tools that default to collecting more student information than the task needs, that retain data indefinitely, that bury overseas transfers deep in a sub-processor list, or that market themselves as fully automatic markers with no teacher review. Data minimisation and teacher control are not just good practice; they shrink the amount of personal information at risk if something goes wrong.
- No clear answer on where data is stored or processed.
- Won't sign your department's data-handling agreement.
- Student work reused to train the vendor's models.
- Collects more personal information than the marking task requires.
- Claims fully automated marking with no teacher review.
What does a privacy-conscious AI marking tool look like in practice?
A privacy-conscious AI marking tool keeps student data in a controlled environment, is transparent about where it is processed, and keeps the teacher in charge of every result. It should align to your own rubric, success criteria and comment banks rather than an opaque scoring model, so the marking reflects your standards while the AI drafts feedback that you review and edit. That combination is what lets a school apply criteria consistently and save marking time without handing over judgement.
JeddAI is built in Australia and used across Australian and New Zealand classrooms. Teachers connect or upload student work, JeddAI drafts marking and feedback aligned to the teacher’s own rubric and comment banks, and the teacher reviews and edits before anything is finalised, which keeps you in control. You can Get started with JeddAI to see how it fits your school’s privacy requirements.
| Privacy area | Question to ask the vendor | Why it matters |
|---|---|---|
| Data residency | Where is student data stored and processed? | Australian storage simplifies compliance and meets many departments' contract terms. |
| Cross-border flows | Is any data sent overseas, and to which sub-processors? | APP 8 makes your school accountable for overseas disclosure of personal information. |
| AI training use | Is student work used to train or fine-tune your models? | Reusing student data to train models can breach purpose-limitation expectations. |
| Access and deletion | Can we export and permanently delete our data on request? | APP 11 and school policies require secure handling and clear retention limits. |
| Breach response | What is your breach notification process and timeline? | The Notifiable Data Breaches scheme requires prompt reporting of eligible breaches. |
| Assurance | Has the product been assessed (for example, ST4S) or certified? | Independent assessment reduces the due-diligence burden on your school. |
Frequently asked questions
Is it legal to use an overseas AI marking tool in an Australian school?
It can be, but under APP 8 your school stays accountable for personal information disclosed overseas, and some education departments require data to stay onshore. Check your department's data policy first.
What is Safer Technologies 4 Schools (ST4S)?
ST4S is a national initiative supported by state and territory education departments that assesses digital products against a shared privacy and security framework, helping schools shortlist tools that have already been reviewed.
Who is responsible if the vendor has a data breach?
Your school remains accountable for the student information it collects, so a strong contract, clear breach-notification terms and the Notifiable Data Breaches scheme all matter when choosing a supplier.
Can we use an AI marking tool without collecting student names?
Often yes. Data minimisation and de-identifying submissions where possible reduce the personal information at risk and can simplify your privacy assessment.
Do we need parent consent to use an AI marking tool?
It depends on what data is processed and your department's policy. Confirm your school's consent and notification requirements before rolling a tool out to classes.
Get started with Jeddle
Jeddle gives teachers and students instant, syllabus-aligned feedback powered by JeddAI.
Looking for study material? Browse Jeddle's Australian-English subject resources, or explore more articles on EdTech & Tools.
