School/examination law (Art. 6(1)(e))
Fulfilling the school's educational mandate carries the processing, as long as AI checks are covered by (or added to) the school or examination policy as part of the assessment process.
!
In short
Checking a submitted text with an AI detector needs a proper legal basis, transparency, and usually a data-processing agreement (DPA) with the tool provider. That legal basis is almost never participant consent, but the institution's own school, examination, or course policy. A signed information and consent statement is still worthwhile - as proof that participants were informed. At the end of this article you'll find two free sample templates as PDF: one for guardians of minor participants, one for adult participants in continuing education.
Why "just get consent signed" isn't enough
The obvious instinct is: hand out a form, get it signed, done. Legally that falls short. Consent under Art. 6(1)(a) GDPR must be freely given - and freedom is structurally limited inside a school relationship: a student or trainee facing a teacher or institution can hardly refuse a check without fearing consequences. Art. 7(4) GDPR requires this power imbalance to be weighed heavily when assessing voluntariness. Data-protection authorities accordingly warn against using consent as the basis for core mandatory school tasks.
THE ACTUAL BASIS
What actually carries the legal basis instead
Course/training contract (Art. 6(1)(b))
For vocational schools, adult-education centres or private course providers, the contract with participants often carries the processing, if the check is part of the agreed service.
Data-processing agreement (Art. 28)
The AI-detector provider needs a DPA that governs purpose, retention, subprocessors and technical/ organisational measures - regardless of which tool is used.
Transparency (Art. 13)
Regardless of the legal basis, participants must be informed what is processed, who has access, and what rights they have - cleanest done in writing, before the first check.
🛈
What the signature actually does: a signed statement doesn't replace any of the four building blocks above - it documents that transparency (block 4) was actually delivered. That's exactly what the templates below are for.
HOW TO ROLL IT OUT
4 steps to a GDPR-compliant rollout
1
Clarify the legal basis
Check whether your school, examination or course policy already covers AI text checks. If not: add it with school leadership or the provider, instead of relying on consent alone.
2
Sign a DPA with the tool provider
Without a data-processing agreement under Art. 28 GDPR, there's no lawful processing - regardless of which tool is used. Reputable providers make the DPA available as standard.
3
Inform participants and check age
Hand out the information statement before the first check runs. For minor participants, guardians usually sign; from roughly age 16, participants often sign for themselves - depending on state law and internal policy.
4
Document the suspicion-case procedure
A high AI score is a reason for a closer review of the work, not automatic proof. For the concrete steps to take on a suspicion, see our article "Suspected AI use: the 5-step process before you talk to parents".
Overview: who signs what
| Audience | Typical legal basis | Who signs the statement |
|---|---|---|
| Minor students | School/examination policy, Art. 6(1)(e) GDPR | Guardians ("Minors" template) |
| Older students (~16+) | School/examination policy, possibly self-consent | Depending on internal policy: participant themselves or still guardians |
| Vocational school / apprenticeship | Training contract, examination policy | Apprentice themselves ("Adults" template) |
| Adult education / courses | Course contract, Art. 6(1)(b) GDPR | Participant themselves ("Adults" template) |
Free sample statements as PDF
Two generic, fill-in-ready A4 templates - usable by any institution and any AI-detection tool, not just PlagiatGPT. Have your own institution or data-protection officer review and adapt before use.
Frequently asked questions
No. The actual legal basis is usually the school or examination policy, or the course contract (Art. 6(1)(e) or (b) GDPR) - not participant consent. The sample statement documents transparency; it doesn't replace the institution's own review of its legal basis.
As a rough orientation, German guidance often treats 16 as the threshold for self-consent (mirroring Art. 8 GDPR). Below that, parents/guardians sign. The exact line depends on state law and the institution's own policy - check with your supervisory authority or data-protection officer if in doubt.
The templates are deliberately generic - they work for general schools as well as vocational schools, adult-education courses or private education providers, regardless of which AI-detection tool is in use.
By Simon Schmidlin
Keywordsai check gdpr school, ai detector data protection, consent ai check student, ai text detection legal basis school, sample consent form ai