Direct answer: UK GDPR applies in full when your business uses AI on personal data — customer names, emails, chat transcripts, even CVs. The ICO’s position: most AI uses are likely high-risk processing, so you need a data protection impact assessment (DPIA); you must tell people you’re using AI; never paste customer personal data into consumer chatbots; and a human must make any decision that refuses someone something that matters. Below is the practical checklist — not legal advice, but the rules as the regulator states them.
Note: this is practical guidance based on published ICO guidance, not legal advice. For high-risk processing, speak to a data protection professional.
Why This Matters Now
Three things converged in 2026. First, AI adoption among UK businesses tripled since 2023 (see our AI statistics for UK small businesses breakdown) — tools are everywhere. Second, the Data (Use and Access) Act 2025 amended the automated-decision rules. Third, the ICO announced a statutory code of practice on AI (June 2026), signalling enforcement attention is only growing. The grace period of “we didn’t know” is over.
The good news: for a typical small business using AI for drafting, marketing and admin, compliance is a checklist, not a legal department.
The 8-Point Checklist
1. Know what counts as personal data
If it identifies a living person — directly or combined with other data — it’s personal data. That includes the obvious (names, emails, phone numbers) and the less obvious (chat transcripts, support tickets, CVs, photos, IP addresses in logs). Before reaching for an AI tool, ask: does this task need personal data at all? Drafting a blog post? No personal data needed. Summarising customer complaints? Yes — handle with care.
2. Never paste customer data into consumer chatbots
This is the single most common breach pattern. Free/consumer tiers of AI assistants typically don’t offer data processing agreements, and your inputs may be used for training. Rules:
- Approved tools only. Maintain a short list of AI tools the business uses — business tiers with DPAs and training-data opt-outs (e.g. ChatGPT Team/Business, Claude Pro/Team with appropriate settings — verify current terms yourself).
- Anonymise first. If you must use a general tool, strip identifiers: “Client A, invoice £840, 21 days overdue” instead of the real name and email.
- Never paste: passwords, bank details, contracts, medical or financial details about identifiable people. Ever.
3. Do a DPIA (it’s smaller than it sounds)
The ICO’s guidance is blunt: “in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA.”
For a small business, a DPIA isn’t a 40-page document. For routine uses (AI-assisted drafting, marketing), it’s a page: what data, why, the risks, your mitigations. For higher-risk uses — a chatbot answering customers, AI screening job applicants — do it properly before you start, and revisit it when the use changes. Where you judge a use low-risk, the ICO still expects you to document how you reached that conclusion — a paragraph suffices.
4. Update your privacy notice
Your privacy notice (or privacy policy page) should now say:
- That you use AI tools, and for what (e.g. “we use AI assistants to help draft correspondence”)
- Which vendors/processors are involved
- That chatbot conversations are with an automated system, with a clear route to a human
This is a 15-minute edit. Our cookie policy page shows the standard of disclosure to aim for.
5. Keep humans in charge of significant decisions
UK GDPR Article 22A (as amended by the Data (Use and Access) Act 2025) restricts decisions “based solely on automated processing” that have a “legal or similarly significant effect” on someone. The ICO updated its draft guidance on these rules on 31 March 2026.
Practical translation for a small business:
| AI can do | A human must do |
|---|---|
| Draft a job rejection email | Decide who doesn’t get the job |
| Summarise applications | Shortlist candidates |
| Suggest credit terms | Refuse credit |
| Flag an unusual transaction | Close an account |
The safe rule: a person makes, and can explain, any decision that refuses someone something that matters. If you can’t explain how the decision was reached, you can’t defend it.
6. Minimise and secure
Two classic GDPR principles, AI-flavoured:
- Data minimisation: feed the AI the minimum it needs. Don’t upload your entire customer database to “ask questions about it” — query the slice you need.
- Security: work accounts only (not personal Gmail logins), strong passwords, approved tools. If an employee pastes something they shouldn’t have, you want to know the same day — make that an explicit rule, not an assumption.
7. Check your ICO fee and vendor contracts
Under the Data Protection (Charges and Information) Regulations 2018, organisations including sole traders that process personal information must pay the ICO’s data protection fee unless exempt. New AI tooling means new processing — check your registration is current.
And check your AI vendors: business plans typically come with a data processing agreement; consumer plans generally don’t. If there’s no DPA, there’s no compliant basis for sending them personal data.
8. Watch what’s coming
The ICO’s planned statutory code of practice (announced June 2026) will cover transparency and explainability, bias and discrimination, and rights and redress — with a mandatory children’s-data component. No consultation timeline yet. Separately, the ICO plans a transparency resource specifically to help SMEs do due diligence on off-the-shelf AI tools, plus guidance on agentic AI under UK GDPR. None of this changes what you must do today — but design your processes toward it.
The 5-Minute Staff Rules
If you have even one employee or freelancer, pin this up:
- Use only our approved AI tools (list them).
- Never paste customer, staff or supplier personal data into an unapproved tool.
- Never paste passwords, bank details or contracts anywhere AI touches.
- Check every fact, figure and name before anything AI-assisted goes out.
- A person makes every decision about a customer or applicant — AI advises, humans decide.
What Happens If You Get It Wrong
The ICO can and does fine small organisations — and beyond fines, there’s the customer trust cost. But perspective helps: the regulator consistently says it prefers to advise and warn first, reserving enforcement for the negligent and the defiant. A small business with a DPIA on file, an updated privacy notice, and staff who know the rules is in a completely different category from one pasting customer lists into a free chatbot. Be the first kind.
FAQs
Does GDPR apply when my small business uses AI?
Yes. UK GDPR applies whenever you process personal data — customer names, emails, even chat transcripts — regardless of whether a human or an AI handles it. Using an AI tool doesn’t transfer your legal responsibilities to the vendor; you remain the data controller.
Do I need a data protection impact assessment (DPIA) for AI?
In most cases, yes. The ICO says the vast majority of AI uses involve processing likely to result in high risk to individuals’ rights, which legally triggers a DPIA. For low-risk uses (e.g. drafting anonymised text), document your assessment in a paragraph instead — but document it.
Can I paste customer data into ChatGPT or Claude?
Not customer personal data into a standard consumer chatbot, no — you can’t guarantee where it goes or how it’s used. Use business/enterprise tiers with data processing agreements and training opt-outs, or anonymise the data first (‘Client A, £840 overdue’). This is the single most common mistake small businesses make.
Do I have to tell customers I’m using AI?
Yes. Your privacy notice should say you use AI tools, for what purpose, and which vendors. If a chatbot talks to customers, it must be obvious it’s automated and how to reach a human. Transparency is a core GDPR principle, not optional.
What are the rules on AI making decisions about people?
UK GDPR Article 22A (as amended by the Data (Use and Access) Act 2025) restricts solely automated decisions with legal or similarly significant effects — refusing a job applicant, for example. The safe rule: a person makes, and can explain, any decision that refuses someone something that matters.
Do sole traders need to pay the ICO data protection fee?
Yes, if you process personal information and aren’t exempt — the ICO explicitly includes sole traders. If you’ve started running customer data through new AI tools, check your fee is paid and your registration is current.
What is the ICO’s AI code of practice?
A statutory code on AI and automated decision-making the ICO announced plans for in June 2026, covering transparency, bias and discrimination, and rights and redress. No publication timeline yet — treat it as direction of travel, while today’s GDPR rules already apply in full.
