AI assistants are brilliant at drafting, summarising and analysing text. That's exactly why people are tempted to paste in emails, customer records, CVs and contracts. If that information identifies a person, UK data protection law applies, whatever tool you use.
This guide is general information, not legal advice. For your specific situation, see the Information Commissioner's Office (ICO) guidance on AI and data protection, or speak to a qualified adviser.
The key question: where does the data go?
When someone types into an AI tool, that text is sent to the provider's servers. What happens next depends on the product and your account type:
- Free and personal accounts may allow the provider to use conversations to improve their models, depending on the settings. You usually have little contractual protection.
- Business and enterprise plans typically commit not to train on your data, offer a data processing agreement, and give you admin controls over who uses the tool and how.
Always check the current terms yourself, because they change. As a simple rule: personal data only goes into AI tools your business has approved, on a business account.
UK GDPR principles that matter most
Lawful basis and transparency
You need a lawful basis for using personal data in a new way, and people should be able to understand how you use their information. If you start using AI to process customer data, update your privacy notice.
Data minimisation
Only use the personal data you actually need. Often you can get the same result by removing names and identifying details first. "Summarise this complaint" works just as well with "the customer" instead of a name and address.
Security and suppliers
An AI provider processing personal data for you is usually acting as your processor. You should have a written contract (often the provider's data processing agreement), understand where the data is stored, and check how international transfers are handled.
Accuracy and human oversight
AI tools can produce plausible but wrong answers. Never let AI alone make decisions that significantly affect people, such as recruitment, credit or disciplinary decisions. The law includes specific rules about automated decision-making, so a person should review and own those decisions.
Never put these into an AI tool without proper safeguards
- Health information, or other special category data such as ethnicity, religion or sexual orientation
- Financial details such as bank or card numbers
- Passwords, API keys or security information
- Confidential client documents you're contractually bound to protect
- Information about children
Five practical steps for this month
- Find out what's already being used. Ask your team which AI tools they use. You may be surprised, and that's fine. You can't manage what you don't know about.
- Choose approved tools and move regular use onto business accounts.
- Write a one-page AI policy. Our AI policy guide includes a structure you can adapt.
- Update your privacy notice if AI tools will process customer or staff data.
- Consider a data protection impact assessment (DPIA) for anything higher risk, such as using AI on large volumes of customer data or to make decisions about people.
Don't let this put you off
Plenty of valuable AI uses involve no personal data at all: drafting marketing copy, writing policies, planning projects, summarising industry reports. Start there while you put the guardrails in place. Our guide on where to start suggests low-risk first steps.