Is AI safe with customer data? A UK GDPR checklist for SMEs

1. Map the data, then cut it down

Start by writing down, in everyday language, what the AI does and what it sees. For example: “The website chatbot receives visitors’ names, email addresses and free-text questions. It answers from our public FAQs and sends qualified leads to our CRM.”

Then ask what the tool really needs. A chatbot answering opening-hours questions does not need access to your whole customer database. An invoice automation needs supplier names and amounts, not your staff’s home addresses. Sharing less reduces the risk and makes every later step easier. When you brief an agency, make data minimisation part of the specification.

Watch out for special category data such as health information, and for children’s data. Both need extra care, and a clinic or care provider using AI should expect to need specialist advice.

2. Choose a lawful basis and tell people

UK GDPR requires a lawful basis for every use of personal data. The ICO’s guide to lawful basis explains the options. For typical SME uses, the most relevant are usually contract (for example, using a customer’s details to handle their booking) and legitimate interests (for example, using AI to sort and prioritise incoming enquiries), which requires you to balance your interests against the person’s.

Whatever basis you choose, people must be told. The ICO’s guidance on the right to be informed sets out what a privacy notice needs to contain. If you add a chatbot or AI phone agent, update your privacy notice to cover it, and consider a short line at the start of the conversation saying that the customer is talking to an automated assistant.

3. Assess the risk: do you need a DPIA?

A data protection impact assessment (DPIA) is a structured way of identifying and reducing privacy risks. The ICO’s page When do we need to do a DPIA? quotes Article 35(1): you must do a DPIA where processing is likely to result in a high risk to individuals.

On AI specifically, the ICO lists “innovative technology”, defined as processing involving innovative technologies or the novel application of existing ones (including AI), among the processing types that require a DPIA when combined with any of the criteria from the European guidelines it refers to.

In practice, a small business adding an FAQ chatbot to its website may not strictly need a DPIA. One using AI to screen job applicants, assess customers’ eligibility or process health information very probably does. Either way, writing a one- or two-page assessment is cheap insurance: it records what you thought about, and it is the first document a regulator or a cautious customer will ask for.

4. Get the supplier contracts right

When an AI vendor or automation platform processes personal data on your behalf, it is usually your processor and you are the controller. UK GDPR requires a written contract between you. The ICO’s page on what needs to be included in the contract explains that, under Article 28(3), the contract must set out the subject matter and duration of the processing, its nature and purpose, the types of personal data and categories of people, and your obligations and rights as controller.

For most SaaS AI tools this contract is a data processing agreement (DPA) that you accept alongside the terms. Before you sign up, check:

• that a DPA exists and covers the service you are using;
• whether your inputs are used to train or improve the supplier’s models, and whether you can switch that off;
• how long prompts, transcripts and files are retained, and whether you can delete them;
• which sub-processors (for example, the underlying model provider) receive the data.

If an agency builds the system, ask for a list of every service in the chain. An n8n or Make workflow that calls a language model, a transcription service and a CRM involves several processors, and each one needs to be covered.

5. Know where the data goes

Many AI services process data outside the UK, often in the USA. Sending personal data abroad is a restricted transfer under UK GDPR and needs a legal route. The ICO’s international transfers guidance covers the options: UK adequacy regulations (including the UK’s adequacy regulations for the US, known as the UK Extension, which cover only US organisations certified under that scheme), or appropriate safeguards such as the ICO’s international data transfer agreement or addendum.

For an SME, the practical step is to check your supplier’s data processing terms for the transfer mechanism they rely on, and to choose UK or EU data hosting where it is offered and it matters to your customers.

6. Keep people in the loop on decisions

Using AI to draft an email is very different from using AI to decide whether someone gets a quote, a job interview or credit. UK GDPR has specific rules for significant decisions made solely by automated means.

These rules have changed. The ICO’s page on the Data (Use and Access) Act 2025 (updated 19 June 2026) says that all of the Act’s data protection provisions are now in force. On automated decision-making, it says the Act opens up the full range of lawful bases, potentially including legitimate interests, for significant automated decisions, as long as appropriate safeguards are applied (telling people about the decision, letting them make representations, contest it and ask for a human to review it). This does not apply to special category data, which remains more protected. The ICO has consulted on updated guidance about automated decision-making.

The simplest way to stay safe is good design: let the AI sort, summarise and suggest, and have a person make or genuinely review any decision that significantly affects someone. Some agencies build this in from the start: OxTech Automation in Oxfordshire, for example, says on its website that important decisions, sensitive communications and uncertain cases should stay with a person.

The same ICO page notes another change that affects every business: you must take steps to help people make data protection complaints (such as an electronic complaints form), and acknowledge complaints within 30 days.

7. Be ready for a breach

AI tools add new places where data can leak: a shared chatbot transcript, a misconfigured automation that emails the wrong customer, an API key posted in the wrong place. The ICO’s guide to personal data breaches says you must report a notifiable breach to the ICO without undue delay and not later than 72 hours after becoming aware of it. You can provide information in phases if you do not have all the details yet. If the breach is likely to result in a high risk to people, you must also tell them.

The ICO has a short, practical guide for small organisations: 72 hours: how to respond to a personal data breach. Make sure your supplier contracts require prompt notification to you, because the clock starts when you become aware.

8. Keep it secure and respect people’s rights

UK GDPR requires appropriate security for personal data. In practice that means limiting who can access the tool, using strong logins, and deleting data you no longer need. People also keep their rights when AI is involved: you must be able to find, correct or delete someone’s data on request, usually within one month. Check that your supplier lets you do this.

Questions to ask an AI agency before you sign

Whoever builds your system, these questions quickly show whether they have thought about data protection:

1. Which services will process our customers’ data, and where are they hosted?
2. Is there a data processing agreement with each one, and are our inputs used for model training?
3. What personal data does the system actually need, and what have you left out?
4. Where does a person review or approve the AI’s output?
5. How are logs and transcripts stored, for how long, and who can see them?
6. Will you help us update our privacy notice and, if needed, our DPIA?
7. What happens to our data and workflows if we stop working with you?

A good agency will welcome these questions. If the answers are vague, keep looking.

Find help

If you want an outside view before you start, look at agencies that offer AI strategy and audits. Some publish fixed prices, such as Caledapt in Perth (operational automation assessment, £695, published) and Skirr AI in Edinburgh (Quick-Win Review, £247, published). Check with any agency whether data protection is covered in their scope. For specific projects, see our pages on AI chatbots, CRM and lead automation and document processing, or browse agencies in London, Manchester and Edinburgh.

There are 277 agencies in our UK directory, each listed with its sources and the date we checked it. Read how we list agencies, or get matched with suitable agencies for free.

This checklist is general information, not legal advice; it reflects ICO guidance as at October 2026.