This is a plain-English summary for business owners, not legal advice. For anything high risk, take proper advice and read the ICO guidance on AI and data protection.
The short version: UK GDPR did not change when AI arrived. Using AI is a processing activity like any other, and the same principles apply. What changes is that a few of those principles, which most businesses previously satisfied without thinking, now need actual attention.
The four that need real attention
-
Lawful basis
You still need one, and legitimate interests is the usual candidate for internal automation. That means doing and recording a balancing test: your interest against the effect on the individual. Consent is rarely the right basis for back-office processing, and it is fragile because it can be withdrawn.
-
Data minimisation
The temptation with AI is to send the whole record because it is easier. The principle says send what the task needs. In practice this usually means redacting or omitting fields before they leave your systems, which is straightforward engineering and rarely done by default.
-
Automated decision-making
Article 22 restricts decisions made solely by automated means that have legal or similarly significant effects on someone. Sorting invoices is not that. Automatically declining an application, or a decision affecting someone credit or employment, may well be. The fix is usually meaningful human review rather than abandoning the automation.
-
Transparency
Your privacy notice should reflect what actually happens, including that personal data may be processed by a model provider as a processor. A notice written before you adopted AI probably does not say that.
The DPIA you probably do need
A Data Protection Impact Assessment is required for processing likely to result in high risk to individuals. The ICO treats innovative technology, including AI, as a factor pointing towards that, particularly when combined with large-scale processing or automated decision-making.
For a lot of internal automation the honest conclusion of a DPIA is that risk is low and mitigated, and that is a fine outcome. The point is having done and documented the assessment, not reaching a dramatic conclusion. It is a few pages, not a project.
Processors, transfers and contracts
A model provider handling personal data on your instructions is a processor, which means you need a written agreement meeting the Article 28 requirements. Most major providers offer one for their business tiers; consumer products often do not, which is a large part of why the tier you use matters.
If processing happens outside the UK you need a transfer mechanism, typically the IDTA or the UK Addendum to the EU standard clauses, plus a transfer risk assessment. Choosing a UK or EU processing region avoids much of this, which is usually the simpler path.
Accuracy, and the thing people forget
The accuracy principle applies to outputs as well as inputs. If an automation writes something into a customer record, that becomes personal data you are responsible for. An exception queue where a human checks low-confidence results is not just good engineering; it is how you meet this obligation in practice.
Individuals also keep their rights. If someone asks what you hold, the answer has to include anything the automation generated and stored about them.
What good looks like in practice
A data-flow diagram showing what leaves your systems and where it goes. A UK or EU processing region. Business API tiers with a processor agreement, never consumer chat products. Fields minimised before sending. A human in the loop for anything consequential. A DPIA on file. A privacy notice that matches reality.
None of that is exotic, and it is what we provide in writing during scope. See the five questions to ask about your data.
Questions we get asked
Do we need consent to use AI on customer data?
Usually not. Legitimate interests or contract are more commonly the appropriate basis for operational processing. Consent brings a withdrawal right that makes back-office automation fragile, so it is rarely the right tool.
Is a DPIA legally required for every AI project?
No, only where processing is likely to result in high risk. But AI is a factor pointing that way, and doing a short one is cheap insurance even when the conclusion is that risk is low.
Can we use AI for hiring or credit decisions?
With considerable care. Those are the decisions Article 22 is aimed at. In practice that means meaningful human review rather than a rubber stamp, plus the ability to explain the decision.
Does data leaving the UK breach GDPR?
Not automatically. It requires a valid transfer mechanism and a risk assessment. Choosing a UK or EU processing region is usually simpler than papering the transfer.
Who is responsible if the model provider has a breach?
You remain the controller and carry the primary obligations to individuals and the ICO. That is exactly why the processor agreement and the subprocessor list matter.