Quick answer: AI tools and UK GDPR can work together, as long as you remove personal data you do not need, use business plans with proper data terms for customer information, mention AI in your privacy notice, and give staff clear written rules.
Every day, small business owners paste customer emails, CVs, invoices and spreadsheets into AI assistants to save time. Most never stop to ask whether that is allowed. Under UK data protection law, it might not be – or it might be perfectly fine, as long as you have taken a few sensible steps first.
This guide explains, in plain English, how AI tools and UK GDPR fit together for small businesses using assistants such as ChatGPT, Claude, Gemini and Microsoft Copilot. It is general information, not legal advice. For your specific situation, the Information Commissioner’s Office (ICO) website has detailed guidance, and a data protection specialist can help.
Table of Contents
AI tools and UK GDPR: the short answer
You can use AI tools in a way that complies with UK GDPR, but personal data needs care. Before putting information about customers, staff or anyone else into an AI tool, you need to know how that tool handles the data, have a lawful reason for using it that way, and be open with people about it. The simplest and safest habit is to remove personal details before you paste whenever the task does not need them.
What counts as personal data?
Personal data is any information that relates to an identifiable living person. In a small business that includes far more than you might think:
- Customer names, email addresses, phone numbers and home addresses
- Order histories and booking details linked to a person
- Emails and messages written by or about a customer
- CVs, interview notes and employee records
- Photos and recordings of people
- Notes about a person’s circumstances, preferences or complaints
Some information is “special category” data and needs extra protection – for example health information, religious beliefs, ethnicity or trade union membership. Be especially careful never to put this into general AI tools without proper safeguards.
Why AI tools raise data protection questions
When you paste information into an AI assistant, you are sending it to another company’s systems, often outside the UK. Three questions matter:
- Is the data stored, and for how long? Many tools keep conversation history unless you delete it or change settings.
- Is the data used to train the AI? Some consumer plans may use conversations to improve models unless you opt out. Business plans generally do not by default.
- Where is it processed? Sending personal data outside the UK is allowed, but there are rules about the safeguards that must be in place.
Consumer plans vs business plans
This is the single most important distinction for a small business. Most AI providers offer two types of service:
| Consumer plans (Free, Plus, Pro) | Business plans (Team, Business, Enterprise, Workspace, Microsoft 365) | |
|---|---|---|
| Main purpose | Individual use | Organisational use |
| Training on your data | May be on by default; usually can be switched off | Generally off by default |
| Data processing terms | Standard consumer terms | Business terms, often including a data processing agreement |
| Admin controls | None | Manage users, remove leavers, set policies |
| Suitable for customer personal data? | Generally avoid | Can be, with the right checks |
If staff regularly handle customer or employee data with AI, moving to a business plan is usually the most important step you can take. Compare costs in our guides to ChatGPT pricing, Claude pricing and Gemini pricing.
The UK GDPR principles, applied to AI
Lawfulness, fairness and transparency
You need a lawful basis for processing personal data – often “legitimate interests” or “performance of a contract” for everyday business tasks. You also need to tell people how you use their data. If you use AI tools to process customer information, your privacy notice should say so in general terms.
Purpose limitation
Only use data for the purposes you collected it for. Using a customer’s complaint email to draft a reply to that customer is closely connected to why you have it. Uploading your entire customer list to an AI tool to “see what it finds” is much harder to justify.
Data minimisation
Only share what is necessary. Most AI tasks do not need names or contact details. Replace them with placeholders such as [Customer] or [Order number] before pasting.
Accuracy
AI can get things wrong. If an AI tool summarises information about a person or helps you make a decision about them, check the output. Never let an AI make significant decisions about people – hiring, firing, credit – without meaningful human review.
Security
Protect accounts with strong passwords and two-step verification, restrict who has access, and remove access promptly when staff leave. Shared logins to a personal AI account are a common weak spot.
Storage limitation
Delete conversations containing personal data when you no longer need them, and check the tool’s retention settings. Our guide to deleting Gemini chats shows how this works in practice.
A simple checklist before using an AI tool with personal data
- Can the task be done without personal data? If so, anonymise first.
- Is the tool a business plan with business data terms?
- Is training on your data switched off?
- Do you know where the data is processed and what safeguards apply?
- Is the use covered by your lawful basis and mentioned in your privacy notice?
- Could the use be high risk – for example, large volumes of data, special category data or decisions about people? If so, consider a data protection impact assessment (DPIA).
- Do staff know the rules? Put them in writing.
A sample AI policy for a small business
A short written policy prevents most problems. Adapt this example:
- Staff may use the AI tools approved by the business: [list tools and plans].
- Do not enter customer, supplier or employee personal data into any AI tool unless the task requires it and the tool is on the approved list for personal data.
- Never enter bank details, passwords, health information or other sensitive data into an AI tool.
- Remove names and contact details from text before pasting whenever possible.
- Check all AI output before sending it to a customer or publishing it.
- AI must not be used to make decisions about individuals without review by a manager.
- Report any mistake – such as pasting the wrong document – to [name] immediately.
What to do if someone pastes the wrong thing
Mistakes happen. A member of staff might paste a full customer list instead of one row, or upload a document containing bank details. If that happens, act quickly and calmly:
- Delete the conversation in the AI tool straight away, and check whether the tool has a separate setting for deleting stored data.
- Record what happened – what data, how many people, which tool, when – even if you decide no further action is needed. UK GDPR expects organisations to keep a record of personal data breaches.
- Assess the risk to the people involved. Consider how sensitive the data was and whether it could cause them harm.
- Report to the ICO if required. Breaches that are likely to result in a risk to people’s rights and freedoms must be reported to the ICO within 72 hours of becoming aware of them. If the risk is high, you may also need to tell the individuals.
- Learn from it. Update your AI policy or training so it does not happen again.
Having a named person who staff can tell immediately makes a huge difference. Most breaches become serious because nobody mentioned them until weeks later.
Practical examples
| Task | Risk | Safer approach |
|---|---|---|
| Drafting a reply to a complaint | Low–medium | Paste the complaint with the name and details removed |
| Summarising a CV for a shortlist | Medium–high | Use a business plan, tell candidates, and make the decision yourself |
| Writing a marketing email | Low | No personal data needed |
| Analysing a customer spreadsheet | High | Remove identifying columns or use a business plan with a data processing agreement |
| Transcribing a staff meeting | Medium | Tell attendees, use a business tool, delete recordings when done |
What about AI features inside tools you already use?
AI is increasingly built into software you already use – email, accounting, CRM and office suites. The same rules on AI tools and UK GDPR apply. Check whether the feature sends data to a third-party AI provider, whether it is covered by your existing contract, and whether you can switch it off. Business editions of Microsoft 365 and Google Workspace generally apply their business terms to their built-in AI features. See our comparison of Copilot vs ChatGPT for more on Microsoft’s approach.
The Information Commissioner’s Office publishes detailed guidance for organisations, including material on artificial intelligence. Use it alongside this guide to check how AI tools and UK GDPR apply to your own business.
AI tools and UK GDPR: frequently asked questions
Is it illegal to put customer data into ChatGPT?
Not automatically, but you must comply with UK GDPR. Using a consumer account with personal data, without telling customers or checking settings, is risky. Remove personal details where you can, or use a business plan with appropriate data terms.
Do I need to tell customers I use AI?
If you use AI tools to process their personal data, your privacy notice should explain this in general terms, alongside other services you use.
Is ChatGPT GDPR compliant?
The question is whether your use of it complies. OpenAI and other providers offer business plans with data processing terms designed to help organisations meet their obligations.
Where can I get official guidance?
The ICO publishes guidance on AI and data protection, including material aimed at small businesses, on its website.
Leave a Reply