UK GDPR and AI: a plain-English checklist for small firms
By Keith Hamilton · · 6 min read
If your business is starting to use AI, UK GDPR still applies to any personal data those tools touch. Most owners do not need a legal department to get this right, but they do need a clear routine. This plain-English checklist sets out the questions to answer before you switch a tool on, and the records worth keeping once it is running.
1. Know what personal data the AI touches
UK GDPR applies whenever personal data is involved, and the rules do not change because the processing is done by AI. Personal data is any information about an identifiable person: a customer's name and email, a staff sickness note, a recorded phone call, or a complaint that mentions someone by name. What AI changes is how easily data can move to new places without anyone noticing.
Start with a simple list for each AI use. Write down:
- what the tool is for, in one sentence
- what personal data goes in, such as names, contact details, order history or free-text notes
- whether any of it is sensitive, such as health information
- what comes out, and where that output is stored
If you cannot answer these questions, you are not ready to use the tool with real customer or staff data. Test it with made-up examples first.
2. Have a lawful basis and use only what you need
You need a lawful basis for using personal data. For many routine business tasks this will be the same basis you already rely on, such as performing a contract with a customer or your legitimate interests. Check that the new use fits what people would reasonably expect.
Then apply data minimisation. Ask what the AI genuinely needs to do the job:
- Can you remove names or account numbers before the data goes in?
- Can you send a summary instead of the whole record?
- Can you switch off any setting that keeps your data for longer than needed?
Less data in means less risk if something goes wrong.
3. Tell people how their data is used
People have a right to know how their information is used. Review your privacy notice and make sure it covers the new use in plain language. If AI is drafting replies to customers, analysing calls or helping make decisions about them, say so.
Being open is also good business. Customers are more relaxed about AI when they are told about it than when they find out later.
4. Check your suppliers and where data is processed
Most small businesses use AI through a supplier, so supplier due diligence matters. Before you sign up, find out:
- Where the supplier processes and stores your data, and whether it leaves the UK.
- Whether your data is used to train or improve their models, and whether you can opt out.
- How long they keep your data and how you can get it deleted.
- What security measures they have in place.
- Whether they offer a written data processing agreement.
If data leaves the UK, there need to be appropriate safeguards in place for that transfer. A reputable supplier should be able to explain this clearly. If they cannot, treat that as a warning sign.
If you serve customers in the EU, you may also need to consider EU rules on AI as well as data protection.
5. Carry out a DPIA for high-risk uses
A data protection impact assessment, or DPIA, is required when processing is likely to result in a high risk to people. AI uses that involve sensitive data, large volumes of personal data, monitoring people, or decisions with real consequences for them often fall into this category.
A DPIA does not need to be a long document. It describes the processing, weighs up the risks to people, and records what you will do to reduce them. Doing one early often shapes a better design, rather than slowing things down.
6. Keep a person able to review significant decisions
People have rights around decisions made solely by automated means that have significant effects on them. Think of decisions about credit, jobs, pricing for an individual, or refusing a service.
The practical answer for most SMEs is simple: keep a person in the loop. Let the AI sort, score or draft, but make sure a trained member of staff can review the result, understand the reasoning and change the outcome. Make it easy for a customer to ask for that review.
7. Keep records and look after security
Good records protect you if questions are asked later. For each AI use, keep a note of:
- the purpose and the data involved
- your lawful basis
- the supplier checks you made
- any DPIA and its conclusions
- who is responsible for the tool
On security, treat AI tools like any other system holding personal data. Use business accounts rather than personal ones, control who has access, switch on strong sign-in protection, and remove access promptly when someone leaves.
The ICO publishes guidance on AI and data protection, which is worth reading once you have the basics in place. This article is general guidance, not legal advice, so if your situation is unusual or the stakes are high, speak to a data protection specialist.
Frequently asked questions
Can staff paste customer details into a free AI chatbot?
It is best to assume not, unless you have checked the tool's terms and settled where the data goes. Free consumer tools may keep what is typed in and use it to improve their service. Set a clear rule in your AI policy and give staff an approved alternative.
Do I always need a DPIA before using AI?
Not always. A DPIA is required when the processing is likely to be high risk to people, which often includes sensitive data, large-scale processing or significant automated decisions. Even when it is not required, a short written assessment is a sensible habit.
Is it enough that my supplier says they are GDPR compliant?
No. You remain responsible for how your business uses personal data, even when a supplier does the processing. Ask the specific questions about where data is processed, how long it is kept and whether it is used for training, and keep their answers on file.
Where Forwardcycle fits
Our safe adoption service includes an AI Governance Pack with an AI policy, data protection impact assessment, vendor checklist and staff guidance, written around how your business actually works. If you are not sure where you stand, take the free AI Readiness Assessment or arrange a free call.