AI and GDPR in the UK: a practical governance guide for smaller businesses

Using AI lawfully in a UK business comes down to four things. Know what personal data goes into it. Have a lawful basis for that use. Run a data protection impact assessment (DPIA) where the risk is high, which the ICO says covers most AI use. And keep a person responsible for checking what comes out. If you sell AI-powered products into the EU, the EU AI Act may apply to you too.

We build these systems rather than advise on the law. This guide covers the design choices that keep you within it. That means what the AI can see, where it runs, and who checks it.

This is general information, not legal advice. For decisions about your own business, speak to a data protection lawyer or your DPO.

Why does governance fall on you?

Because nobody else checks. Build an extension on your house and a building inspector turns up. Build software, and there’s no equivalent.

“If you build an app or a website for a digital product, there are no checks. There are no concerns… You kind of do enter the Wild West.”

AI doesn’t change that. Nobody signs off your chatbot before it talks to customers. The law still applies, but the checking is yours to organise.

What does UK GDPR say about AI?

UK GDPR doesn’t have a separate rulebook for AI. The same principles apply as for any use of personal data: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. AI just makes some of them harder.

The ICO, the UK’s data protection regulator, publishes detailed guidance on AI and data protection. It’s organised around those principles. One thing to know up front. The ICO says the guidance is under review because of the Data (Use and Access) Act 2025, and may change. The core duties aren’t going away, but check the current version before relying on any detail.

Do you need a DPIA for AI?

Probably. A DPIA is a written assessment of the risks a project poses to people’s data, and how you’ll reduce them. Under Article 35 of UK GDPR, you need one when processing is likely to result in a high risk to people.

The ICO’s accountability guidance for AI says that in the vast majority of cases, AI use will involve that kind of high-risk processing. If you decide yours isn’t high risk, it says you should still document why.

According to that guidance, a DPIA for AI should cover:

• a description of the processing and the data flows, including where the AI affects people
• how accurate the system is, and how much its performance varies
• how much a person is involved in decisions
• why the AI is necessary and proportionate, and what less risky alternatives you considered
• your role as controller, and any processors involved, like the AI vendor
• the risks that remain after your safeguards, and whether you need to consult the ICO
• a date to review it

The ICO has a general DPIA guide with templates. For a first project, filling one in honestly is a better use of a morning than any AI strategy deck.

What lawful basis covers AI?

Every use of personal data needs a lawful basis, like consent, contract or legitimate interests. The ICO’s guidance on lawfulness in AI makes three points worth knowing.

• Building and using can need different bases. Training or developing a system is a different purpose from running it, with different risks.
• Legitimate interests isn’t a free pass. The ICO calls it the most flexible basis but warns it isn’t always the most appropriate. You need to weigh your interests against the people affected.
• Special category data needs more. Health, ethnicity, religion and similar data need a lawful basis and a separate condition under Article 9.

In practice, a common gap isn’t the basis itself. It’s that nobody wrote down which basis applies, or told people in the privacy notice that AI is involved.

The Data (Use and Access) Act also added “recognised legitimate interests”, like safeguarding vulnerable people or preventing crime. These skip the balancing test.

Can AI make decisions about people on its own?

Yes, within limits. The Data (Use and Access) Act 2025 replaced Article 22 of UK GDPR with new Articles 22A to 22D. They came into force on 5 February 2026.

The rules cover significant decisions based solely on automated processing. That means no meaningful human involvement, and a legal or similarly significant effect on the person. Rejecting a job applicant or refusing credit are typical examples.

Those decisions are now allowed, as long as you put safeguards in place. Under Article 22C, the person must be able to:

• get information about the decision
• make representations about it
• ask for a person at your business to step in
• contest the decision

Special category data, like health, has tighter limits. A solely automated significant decision using it needs the person’s explicit consent. The only alternative is a contract or legal requirement, plus a substantial public interest condition. You also can’t make one on the basis of a recognised legitimate interest.

If AI screens CVs or scores customers with nobody checking, build those safeguards in from day one. A person who only rubber-stamps the output isn’t meaningful involvement.

Who is the controller when you use an AI vendor?

The ICO says roles depend on who decides the purpose and means of processing, not on what the contract calls each party. If you decide what the AI is for and what data goes in, you’re the controller. A vendor processing data only on your instructions is generally a processor.

That means the duties stay with you. Before you sign, check:

• whether the vendor uses your data to train its models, and whether that’s off by default
• where the data is processed and stored, and how international transfers are covered
• how long it keeps inputs and outputs
• what security certifications it holds, and what happens if it has a breach

The quickest win here is boring. Pay for business accounts. The business plans from the main vendors say inputs aren’t used for training by default, while free personal accounts carry different terms. Our comparison of off-the-shelf AI vs custom covers how the main tools handle this.

What if you don’t want your data leaving the building?

Some clients tell us plainly that they don’t want sensitive data sent to OpenAI, or any other vendor. That’s a reasonable position, and there’s a design answer to it.

You can run an open model on servers you control, or on the device itself. That takes the model vendor out of the picture. It costs more to set up and look after. A cloud host is still a processor, so choose a UK region to avoid international transfers.

Pristine Condition is an example of the second route. Its AI assesses lifting technique through a phone camera, in real time, with no internet connection. The assessment runs on the phone itself, not through a model provider.

How do you keep the trust you’ve built with customers?

Most smaller businesses have spent years earning their customers’ trust, and they don’t want AI to put it at risk. The law sets the floor. Trustworthy AI is the wider standard, and it’s the list we design against.

The US NIST AI Risk Management Framework and the international standard ISO/IEC 42001 both give structure to this. NIST lists these features of a trustworthy system:

• valid and reliable: it does the job, consistently, and you’ve measured that
• safe: a wrong answer can’t hurt someone without a person catching it
• secure and resilient: it holds up against misuse and attack
• accountable and transparent: you can say who owns it and what it does
• explainable and interpretable: you can show why it gave an answer, like the source document it used
• privacy-enhanced: it sees only the data it needs
• fair, with harmful bias managed: you’ve checked it treats groups of people evenly

Bias deserves a word of its own. A model tuned on UK customers may not behave the same way with customers elsewhere. If you expand into a new country, test the system again on people from that market before you rely on it.

Does the EU AI Act apply to UK companies?

It can, even though the UK isn’t in the EU. Article 2 of the AI Act sets out who it covers. Two parts matter for UK firms:

• Providers placing AI systems on the EU market are covered, whether or not they’re based in the EU.
• Providers and deployers outside the EU are covered where the output of their AI system is used in the EU.

A provider builds or supplies the AI system. A deployer uses one in its work. So a UK firm selling an AI-powered product to EU customers is likely to be in scope. A UK firm using AI only for UK work, with UK customers, is much less likely to be.

What does it require, and when?

The Act sorts AI by risk. Some practices are banned outright, high-risk systems carry heavy duties, and some systems carry transparency duties. The European Commission’s implementation timeline shows the dates as amended by the Digital Omnibus on AI, in force since 27 July 2026:

If you’re in scope, check the AI literacy duty and the transparency duties now. Article 4 asks providers and deployers to take steps to build their staff’s AI literacy. Under Article 50, a chatbot must be built so people know they’re talking to AI, unless that’s obvious. Annex III’s high-risk list includes areas like recruitment and creditworthiness. If you use AI to screen CVs or assess customers in the EU, take advice early.

What about security?

Data protection law also requires appropriate security, and AI brings a few new ways to get it wrong.

• Over-broad access. An assistant connected to your whole shared drive can surface a payroll file to anyone who asks. Limit it to what the person asking may see.
• Instructions hidden in content. A document or email can contain text written to steer the AI, known as prompt injection. Don’t let AI act on external content without checks.
• Leaky logs. Prompts and outputs often contain personal data. Give logs access controls and a retention period.
• Unknown tools. Browser extensions and meeting note-takers can send recordings and documents to services nobody approved.

How do you put AI governance in place in a small business?

You don’t need a committee. You need a short policy, a named owner and a habit of checking.

The AI policy checklist

• Name an owner. One person accountable for AI use, who signs off new tools.
• List the tools. Every AI tool in use, who uses it, and what for. Include the ones staff signed up to themselves.
• Use business accounts. No personal accounts for work data. Check each tool’s training and retention settings.
• Set data rules. Say plainly what staff may paste in, and what they mustn’t, like health, payroll or customer records.
• Record the processing. Add each AI use to your records of processing, with its lawful basis.
• Run DPIAs. Do one for any AI use touching personal data, or write down why it isn’t needed.
• Update privacy notices. Tell customers and staff where AI is involved in handling their data.
• Keep a person in the loop. Decide which outputs a person must check before they reach a customer or a payslip.
• Measure it. For custom systems, keep a test set and an accuracy figure, and log inputs, outputs and approvals.
• Review twice a year. Tools, terms and the law all change. Put a date in the diary.

Most of this is an afternoon’s work for a small business. The DPIAs take longer, and they’re where the real thinking happens.

What does good look like with sensitive data?

Everyone’s Invited is a charity where young people share experiences of sexual abuse and harassment. The submissions are about as sensitive as data gets, and the charity was receiving over 100 a day.

The AI system we built strips names, dates and locations from each submission automatically, before review or publication. Privacy came first and the time saving followed. It handled the review of more than 50,000 submissions and saved around 12,500 hours of manual anonymisation.

The governance lesson is that the AI made the data safer, not riskier. It reduced how much identifying information people saw. That’s the kind of AI use a DPIA is designed to bring out.

When isn’t this worth hiring someone for?

• You’re only using licensed assistants for drafting. A one-page policy and the right account settings cover it. Write it yourself from the checklist above.
• You need a legal opinion. That’s a lawyer’s job, not ours. We’re engineers who build with data protection in mind.
• No personal data is involved. If the AI never touches information about people, most of this guide doesn’t apply.

Where we help is when the AI system itself needs designing around the rules. That means what data it can see, what it logs, where it runs and when a person steps in. Our AI + data service covers how we approach that.

If you’re planning an AI project that touches personal or sensitive data, talk to us before you build. We’ll look at the job and the data, and tell you plainly what it would take to do it safely.