GDPR and AI: a UK small-business checklist

Is AI GDPR compliant?

No tool is compliant by itself. Compliance depends on how you use it: what personal data goes in, what the contract with the supplier says, where the data is stored and whether a person checks the output. The rest of this guide takes those in turn.

Does UK GDPR apply to AI?

Yes, when the AI handles personal data. Personal data means information about an identifiable person, such as a client's name, email, bank details or a note about their case. If a tool reads, stores or produces that kind of information for your business, UK GDPR is in play.

The ICO, the UK's data protection regulator, publishes a guide called Guidance on AI and data protection. Its job is to explain how the UK GDPR principles apply to personal information used in AI systems. There is no separate small-business rulebook for AI. The same rules apply, whether the tool is a chatbot, an email assistant or a workflow that files invoices.

Some AI jobs involve no personal data at all, such as drafting a generic price list or summarising a public report. Those are outside this guide. The trouble starts when a name, an address or a client file goes in.

Is using AI a breach of GDPR?

No. Using an AI tool is not a breach in itself. What counts is how you handle the personal data that goes in, and whether you can show you handled it properly.

The ICO has a specific meaning for a personal data breach. In its guide to personal data breaches, it is a security breach that accidentally or unlawfully destroys, loses, alters or discloses personal data, or allows unauthorised access to it. That covers accidents as well as attacks.

So a member of staff pasting a client's details into a tool you have not approved could be a breach, depending on what happened to the data. Where a breach is likely to put people's rights and freedoms at risk, you must report it to the ICO without undue delay and no later than 72 hours after you become aware of it. If you decide not to report, write down why.

What are the seven UK GDPR principles, and what do they mean for AI?

The ICO's guide to the data protection principles lists seven. The table shows each one, followed by a plain question to ask about any AI tool you use. The questions are my own reading, not ICO wording.

Accuracy deserves a special mention. AI tools can produce confident, wrong answers. If the output is about a real person, such as a summary of their account, a person should read it before it is used.

The ICO's AI guidance also covers fairness, bias and automated decision-making, which matters if software ever decides something important about someone without a person involved. Most small-business uses, such as drafting replies or filing documents with a person checking, are a long way from that. If you are heading towards it, take advice first.

Has the law changed, and is the ICO guidance up to date?

Parts of it have. The Data (Use and Access) Act 2025 got Royal Assent on 19 June 2025. The ICO says the Act is being brought into force in stages, so check its page on the Act for where things stand now.

Because of those changes, the ICO has put a notice on much of its guidance saying it is under review and may change. The notice appears on its AI and data protection guidance, its data protection principles guide, its DPIA guidance and its pages on contracts and processors, all of which I read on 26 October 2026. One page, on purpose limitation, has already been updated to reflect the Act.

What does that mean for you? The basic ideas in this guide, such as knowing where data goes and having a contract with suppliers, are long-standing. But detail can change, so check the ICO's current pages, and its plans for new and updated guidance, before you rely on anything specific. I have dated every source below.

What is shadow AI, and why is it the biggest risk?

Shadow AI means staff using AI tools for work that you have not approved or do not know about. It is the same idea as shadow IT, where people use their own apps because the official option is slower. It happens because AI is useful. A person who has a long email thread to summarise will paste it into whatever is open in their browser.

That is the risk. The pasted text might contain a client's name, financial details, health information or a complaint. Whether the tool keeps it, who at the provider can see it and whether it is used to improve the provider's models depends on the product and the plan. Free and paid personal accounts often have different terms from business accounts, and the terms change, so read the current ones for any tool your team uses. A chatbot on a personal login is also a poor fit for accountability, because you cannot show what went in.

Here is an illustration, not a real case. Take a five-person bookkeeping practice where the owner has never mentioned AI to the team. One bookkeeper has been pasting messy client emails into a free chatbot to tidy the wording. She means well and saves time. But the practice has no record of it, no contract with the provider and no idea what was shared.

Banning AI outright rarely works, because people carry on quietly. A short rule and an approved alternative works better.

1. Ask what people are already using Do it as a friendly conversation, not an investigation. You cannot manage what you do not know about.
2. Write a one-page rule Say which tools are approved, what must never be pasted in (client names, financial details, health information, anything under an NDA) and who to ask if unsure.
3. Provide a sensible option If the approved tool is worse than the free one, people will go round it. Pick something that does the job.
4. Switch off what you can Where a tool has settings for history or training, set them centrally on a business account rather than leaving it to each person.
5. Make it easy to own up If someone pastes the wrong thing, you want to hear about it the same day. The 72-hour clock runs from when you become aware.

Do I need a data processing agreement with an AI supplier?

If a supplier handles personal data on your behalf, almost certainly yes. The ICO is clear that whenever a controller uses a processor, there must be a written contract (or other legal act) in place. See its page on contracts.

The two terms are simple. You are the controller: you decide why and how the personal data is used. The supplier is the processor: it handles the data for you, on your instructions. The ICO says that if a processor uses data for its own purposes, it steps outside that role and becomes a controller for that use. See its page on what it means to be a processor.

The contract is usually called a data processing agreement, or DPA. The ICO says it must cover points including:

• the subject matter and duration of the processing, and its nature and purpose
• the types of personal data and the categories of people involved
• processing only on your documented instructions
• security measures and a duty of confidence for staff
• conditions for using sub-processors, including your prior authorisation
• help with data subjects' rights requests, breach notification and impact assessments
• deleting or returning the data at the end

Some AI providers offer a standard DPA with their business plans. Whether one is available depends on the tool and the plan, so check before you buy. If a supplier cannot give you one, treat that as a warning.

The same goes for anyone who builds or runs AI for you. I will sign a DPA if you ask for one, and you should expect to ask any supplier, including me.

Where does my data go, and is it used to train the AI?

These are the two questions to ask any supplier, and the answers should be specific. Where is the data stored? Which companies process it? Does the provider use it to train its models?

Here is how I handle it, so you can compare. Client data is stored in the UK. The AI models themselves are reached through providers' services hosted in Europe, which is the best option available for the models I use. I only use business API accounts, and the terms of those accounts say your data is not used to train the providers' models.

Note that storing data in the UK is not the same as every step staying in the UK. If personal data goes to a separate organisation outside the UK, the ICO calls that a restricted transfer. It must be covered by UK adequacy regulations, appropriate safeguards or an exception, and the rules apply to small, infrequent transfers too. The ICO has a guide to international transfers that is a good starting point. A data protection adviser can tell you what your own set-up needs.

Do I need a DPIA?

Sometimes. A DPIA, or data protection impact assessment, is a written check of the risks to people before you start a project. One is needed, according to the ICO, where processing is likely to result in a high risk to people's rights and freedoms. See its guidance on when you need to do a DPIA.

Its examples of innovative technology include artificial intelligence and machine learning. Under its list, innovative technology calls for a DPIA when it is combined with another factor, such as scoring or evaluating people, or using sensitive data. You can also decide a DPIA is needed without those other factors.

In practice, that means a small business drafting marketing copy probably does not need one. A firm planning to run client files, health information or financial records through an AI tool should at least do the screening, and keep a note of the answer. That note also helps with accountability.

This guidance is under review as a result of the Data (Use and Access) Act, according to the ICO, so check its current page before you decide.

A UK GDPR and AI checklist for a small business

This is the short version. Tick each item or write down why it does not apply to you. It is a starting point for a conversation with an adviser, not a compliance certificate.

1. List the AI tools in use Include free accounts, browser add-ons and features inside software you already pay for. Ask staff, and do not rely on guessing.
2. Decide what must never go in Write it down. Client identities, financial details, health information and confidential documents are the usual candidates.
3. Choose an approved tool for each job Prefer business accounts with settings you control, and turn off training and history where you can.
4. Get a DPA for every supplier that handles personal data Keep a copy. Note who the sub-processors are.
5. Check where data is stored and processed Write the answer down, including anything outside the UK.
6. Screen for a DPIA Do it before you start any project that puts client files through AI. Keep the note.
7. Update your privacy notice Say, in plain words, that you use AI tools and what for, if personal data is involved. Check the wording with an adviser.
8. Keep a person in the loop Someone reads anything AI produces before it reaches a client or affects a decision about a person.
9. Know your breach steps Who decides if something is reportable, who tells the ICO and where the 72 hours is tracked.
10. Review every few months Tools, terms and ICO guidance change. Put a date in the diary.

When does private AI make sense?

A business plan from a reputable provider, with a DPA and training switched off, is enough for many jobs. It is also the cheapest route. But some firms hold material that makes even that feel like too much, such as solicitors with case files or accountants with full client records.

For those, the AI can run as a private AI set-up that is separate from public chatbots and set up around your own documents. It does not remove your duties under UK GDPR. You still need the contract, the rule for staff and the checks above. What it changes is how much of your data leaves your control.

If you are not sure which side of the line your business sits on, an AI audit from £495 would look at how you work, which data is involved and what is sensible to automate. It is not a legal review.

What this guide does not cover

This guide does not cover the EU AI Act, employment law questions about whether staff can refuse to use AI, or rules specific to your profession. Regulated professions such as solicitors, accountants and financial advisers have their own regulators, and each has its own current guidance. Check it directly and do not rely on a general guide like this one.

I build AI and automation for small businesses. I am not a data protection officer, a solicitor or a regulator, and nothing here replaces advice on your own situation.