I am not 100% sure here, but when i look at one of my own Policies i have two arguments for the update method, the first argument is the user, and the second is the model being acted upon.
/**
* Determine whether the user can update the page.
*
* @param User $user
* @param Page $page
* @return mixed
*/
public function update(User $user, Page $page) : bool
{
// ...
}
In your case i think your update method needs to accept two arguments, the first being the currently authenticated user, the second argument being the StudentData you want to check if the user can update.