Using AI Tools in Your Business: What GDPR Requires
71% of UK employees have used AI tools at work that their employer never approved.
That figure comes from Microsoft research carried out by Censuswide in October 2025, surveying 2,003 UK workers. Half of them still use those tools every week. Only 32% said they worried about the privacy of the company or customer data they paste in.
So if you run a small business and think "we don't really use AI", I'd check that assumption first. Your team almost certainly does. The question is whether you know which tools, and what information goes into them.
I get asked about AI more than any other subject at the moment. The good news: UK GDPR doesn't need a special AI chapter to apply. The rules you already follow for any other supplier or system cover it. The bad news: most businesses haven't applied them to AI yet.
Below I've set out what the law requires, in the order I'd tackle it with a client.
First, a word on where the rules stand in 2026
The ICO's main Guidance on AI and data protection dates from March 2023. It now carries a banner saying it is under review because of the Data (Use and Access) Act 2025 (DUAA).
That doesn't create a gap. Parliament gave the ICO a statutory duty, in force from 12 May 2026, to produce a code of practice on AI and automated decision-making. That code is expected in 2027. In the meantime, UK GDPR applies in full to any AI tool that touches personal data. Customer names in a prompt, a CV uploaded for summarising, a meeting transcript with staff comments: all of it counts.
1. Find out what your team actually uses
You can't comply with rules for tools you don't know about. Accountability under Article 5(2) means you have to show how you handle personal data, and your records of processing need to reflect reality.
Start with a short, honest survey. Ask staff which AI tools they use, what for, and whether they've ever pasted in customer, client or employee details. Make it clear nobody gets in trouble for answering. You want the truth, not a tidy list.
Then write a one-page AI policy covering:
which tools staff may use, and on which account type
what information they must never enter (special category data, client files, HR records)
who to ask before trying a new tool
Banning AI outright tends to push usage underground. An approved tool with sensible rules gives you far more control.
2. Check what happens to the data you put in
This is where the free versions catch businesses out.
Take ChatGPT as an example. OpenAI's own help pages say it uses content from free and Plus accounts to improve its models by default, unless the user switches off "Improve the model for everyone" in their settings. For ChatGPT Business, Enterprise, Edu and the API, OpenAI says it does not use inputs or outputs for training by default.
Read that again. The same tool, used by the same employee, handles your customers' data in two very different ways depending on which account they log into.
When you use an AI supplier to process personal data on your behalf, UK GDPR treats you as the controller and the supplier as your processor. Article 28 requires a written contract with specific terms: the supplier acts only on your instructions, keeps the data secure, uses approved sub-processors, and deletes or returns the data at the end. A personal account signed up to with a Gmail address gives you none of that.
Most major AI providers are based in the US, so you also need a lawful mechanism for the international transfer. That could be the UK-US data bridge, if the provider has certified under it, or the ICO's International Data Transfer Agreement or Addendum. Business-tier AI products usually include this in their data processing terms. Consumer accounts usually don't.
3. Tell people, and keep to your purpose
If you use AI to process personal data, your privacy notice should say so in plain English. People have a right to know what you do with their information and who you share it with.
Purpose limitation matters here too. You collected a customer's details to deliver an order. Feeding their complaint history into an AI tool to profile them for upselling is a new purpose. You need a lawful basis for it, and it has to be compatible with what you told them at the start.
Accuracy applies as well. AI tools can produce confident, wrong statements about real people. If an AI-drafted note about a customer or employee ends up on file, you are responsible for its accuracy under Article 5(1)(d). Someone needs to check it before it goes anywhere.
4. Do a DPIA before you roll anything out
The ICO's list of processing "likely to result in high risk" names innovative technology, and it specifically includes artificial intelligence, machine learning, and applying AI to existing processes. Combine that with another risk factor, such as processing at scale, monitoring staff, or handling health data, and a Data Protection Impact Assessment becomes a legal requirement under Article 35.
The ICO has already shown what it expects. In October 2023 it issued Snap with a preliminary enforcement notice over its "My AI" chatbot. The ICO's concern was that Snap had not properly assessed the data protection risks before launching it to UK users, including teenagers. Snap went on to redo its assessment, and the ICO closed the investigation in May 2024 once it was satisfied.
The ICO called it a "warning shot for industry" and said organisations "developing or using generative AI must consider data protection from the outset". Note the word "using". That covers your business, not only the tech giants.
Commentary on the Snap decision picked out what the ICO found missing: vague retention periods, cursory risk analysis, and mitigations that didn't match the risks. A DPIA for a small business can be a few pages long. It still has to deal with the actual tool, the actual data and the actual risks.
5. Watch for automated decisions
The DUAA rewrote the rules on automated decision-making, and those changes came into force on 5 February 2026.
The new Articles 22A to 22D of UK GDPR allow solely automated decisions with a legal or similarly significant effect on someone under any lawful basis except recognised legitimate interests. The rules are tighter for special category data, such as health information. There, you need explicit consent, or the decision has to be necessary for a contract or required by law, with a substantial public interest condition met.
Wherever you make significant decisions this way, you must put four safeguards in place. The person must be able to:
get information about the decision
make representations about it
obtain human intervention
contest the decision
For a small business, the obvious risk areas are recruitment and credit. An AI tool that sifts CVs and rejects candidates before a person looks at them is making automated decisions about those candidates.
The ICO consulted on draft guidance on this from 31 March to 29 May 2026. The draft says human involvement has to be meaningful: a person with the authority and competence to change the outcome, reviewing it before it applies. A manager clicking "approve" on whatever the software recommends doesn't meet that bar.
What happens if you get it wrong
Under UK GDPR, the ICO can fine up to £17.5 million or 4% of global annual turnover, whichever is higher. It can also issue enforcement notices ordering you to stop processing.
Regulators elsewhere have already acted against AI companies. In December 2024 Italy's data protection authority, the Garante, announced a €15 million fine against OpenAI, citing an unreported breach, the lack of a legal basis for training on personal data, weak transparency and missing age checks. A Rome court annulled that fine on 18 March 2026, finding the Garante lacked jurisdiction once Ireland had become OpenAI's lead regulator. The court ruled on procedure. It didn't say the concerns were wrong.
For most small businesses, though, the realistic risk looks different. A customer complains, or a disgruntled employee makes a subject access request and finds their details sitting in an AI tool nobody told them about. Then you're explaining to the ICO why there's no contract, no DPIA and no policy.
Your AI and GDPR checklist
List every AI tool your team uses, including the ones on personal accounts
Move business use onto business-tier accounts with a data processing agreement
Check where each provider stores data and what transfer mechanism covers it
Switch off model training where the setting exists
Update your privacy notice and your records of processing
Run a DPIA for anything that monitors staff, uses sensitive data or works at scale
Put a human in front of any AI output that decides something about a person
Write a one-page AI policy and tell staff about it
If you're unsure whether your business needs a formal data protection role to oversee all this, I've covered that in Do You Actually Need a Data Protection Officer?
I work with UK businesses as their outsourced DPO, and AI reviews now make up a growing share of that work. If your team is already using AI and you haven't checked any of the above, book a free, no-obligation chat with me. We'll work out where you stand in 30 minutes.
References
Microsoft UK, Rise in 'Shadow AI' tools raising security concerns for UK (13 October 2025; Censuswide survey of 2,003 UK employees)
ICO, Guidance on AI and data protection (under review following the DUAA)
Arnold & Porter, The UK ICO's new statutory duty to produce an AI code of practice (August 2026)
OpenAI Help Center, How your data is used to improve model performance
ICO, ICO warns organisations must not ignore data protection risks as it concludes Snap 'My AI' chatbot investigation (21 May 2024)
Bird & Bird, Snap My AI: ICO decision has lessons for everyone undertaking DPIAs (2024)
AI and automated decision-making in the UK (Part I): the new rules and regulatory guidance
Burges Salmon, Automated decision-making: ICO consults on new guidance following DUAA reforms (2026)
Lewis Silkin, OpenAI faces €15 million fine as the Italian Garante strikes again (14 January 2025)
PPC Land, Italian court kills OpenAI's €15M fine (March 2026)
