Is AI safe for customer data? A UK GDPR checklist

Start with purpose and lawful basis

UK GDPR requires you to have a lawful basis for processing personal data and to be clear about your purpose. Using AI does not change that. If you are using customer data to draft replies, extract details from documents or classify enquiries, write down why, and make sure your privacy notice reflects it.

If the new use differs from what customers were told when they gave their data, take advice before proceeding.

The checklist

1. Lawful basis: identified and recorded for each use.
2. Data minimisation: send the AI only the fields it needs, and strip or mask the rest.
3. Processor agreements: a written contract with each supplier that handles personal data on your behalf.
4. Location: know where data is processed and stored, and check the rules on international transfers.
5. Training: confirm in the provider’s terms whether your data is used to train their models, and choose settings or plans that exclude it.
6. Human review: a person checks outputs that affect customers, especially anything significant.
7. Retention: decide how long inputs, outputs and logs are kept, and delete on schedule.
8. Security: access controls, encryption and logging suitable for the sensitivity of the data.

When you need a DPIA

A data protection impact assessment is required where processing is likely to result in a high risk to individuals. Examples can include large-scale use of sensitive data or automated decisions with significant effects.

Even where it is not mandatory, a short written assessment is a sensible habit. It forces you to identify risks, record your reasoning and show you thought it through. The ICO publishes guidance on when and how to carry one out.

Automated decisions and transparency

UK GDPR contains specific rules on solely automated decisions that have legal or similarly significant effects on people. If AI is only drafting or suggesting, with a person making the decision, you are in a different position than if it decides alone.

Be open with customers about where AI is used, give them a route to a human, and make sure you can explain in plain terms what the system does with their information.

Where to get authoritative guidance

The Information Commissioner’s Office (ico.org.uk) publishes guidance on AI and data protection, DPIAs and processor responsibilities, and it is updated as the position develops.

This article is general information and not legal advice. For anything involving sensitive data or higher-risk uses, speak to a qualified adviser or your data protection officer if you have one.

Frequently asked questions