Picture a busy office pasting customer emails into an AI tool to draft replies. It saves time, but those emails hold names, addresses and sometimes sensitive details. This guide explains how AI and GDPR fit together for a UK small business. It covers the questions to ask, and when to bring in a qualified adviser. It is general information, not legal advice.
Does GDPR apply when your business uses AI?
Yes, whenever the AI tool handles personal data. In the UK that means the UK GDPR and the Data Protection Act 2018. Personal data is any information relating to an identified or identifiable living person, directly or indirectly. Customer emails, call notes, job applications, photos and order histories all count.
The rules apply to what you do with the data, whatever the technology. Asking a tool to summarise an enquiry, sort job applications or suggest a reply is still processing personal data. Your business remains responsible for that use, even when a supplier runs the software.
If the tool only works with information that identifies nobody, such as a draft product description, the data protection questions are much smaller. Many businesses start there for exactly that reason.
What should you check before using AI with personal data?
Start with a written description of one task, the data it uses and the result you expect. Then work through these questions with the person responsible for data protection in your business. Take each unclear answer to a qualified adviser.
- Purpose: what exactly will the tool do, and is personal data actually needed for it?
- Lawful basis: which lawful basis applies to this use, and does it match what you told people when you collected their details?
- Minimisation: can you remove names, contact details or account numbers before the data reaches the tool?
- Supplier role: is the supplier acting only on your instructions, and is there a written contract covering that?
- Training and retention: does the supplier keep your inputs or use them to improve its systems, and can you switch that off?
- Location: where is the data stored and processed, and does it leave the UK?
- Security and access: who in your team can use the tool, and what can they paste into it?
- People's rights: could you find, correct or delete someone's information if they asked?
Write the answers down. A short record shows what you decided and why, which matters if a customer, an employee or the regulator asks later.
When might you need a data protection impact assessment?
A data protection impact assessment (DPIA) is required when processing is likely to result in a high risk to people. It helps you spot and reduce risks before you start.
The Information Commissioner's Office (ICO) is the UK data protection regulator. Its guidance on impact assessments explains the triggers and lists innovative technology, including AI, among the factors that can point to high risk.
An AI tool that drafts marketing ideas from public information may sit at the low end. A tool that screens job applicants, assesses customers or reads health details is very different. Whether your use needs a DPIA depends on the details, so ask a qualified adviser to confirm before you go live.
Rather have it done for you? We build your website free, it goes live in days, and you pay nothing for the first 14 days. No card needed. See how the free 14-day trial works.
What about AI making decisions about people?
Take particular care when AI influences a decision that affects someone significantly. Examples include whether they get a job interview, a service or credit. The UK GDPR contains specific rules on automated decision-making, and the Data (Use and Access) Act 2025 changed them.
The ICO's guidance on AI and data protection carries a notice about this. It says: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change". Check the current position with a qualified adviser rather than relying on older summaries. A practical safeguard is to keep a trained person reviewing each significant decision.
What does a sensible approach look like in practice?
The following is an illustrative example, not a customer case study. A small lettings agency wants AI to summarise maintenance requests so staff can respond faster.
- Map the data. The agency lists what a typical request contains: tenant name, address, phone number and a description of the fault.
- Reduce it. Staff remove the phone number before the summary step, because the summary does not need it.
- Check the supplier. The agency reads the supplier's terms, confirms how inputs are stored and turns off any option to use them for training.
- Keep people in charge. A member of staff reads each summary before acting on it. The tool never contacts tenants on its own.
- Record and review. The agency notes its decisions, updates its privacy information and asks its adviser to review the plan.
None of these steps is complicated alone. Together they show the business understood the risk and acted on it.
Why does getting AI and GDPR right take time?
The hard part is not the software. It is knowing exactly what data moves where, who can see it and what happens when something goes wrong. That means reading supplier terms carefully, testing with realistic examples and talking to the people who do the work.
Data protection law is also changing. Guidance is being revised after the 2025 Act, and supplier settings change between versions. Someone needs to own the review, check new features before staff use them and keep the record current.
For the legal questions, use a qualified data protection adviser or solicitor. The practical work is different. Mapping the workflow, setting up the tool and training staff need someone who understands both the technology and your business.
How can Buzzozo help with AI and data protection?
Buzzozo's AI consultancy helps you choose a sensible first task, map the data it uses and design the workflow so people stay in control. We can help you prepare clear questions and documents for your data protection adviser. We do not give legal advice, and we will tell you when a question needs one.
Ask us to explain the scope and cost of any AI work before you commission it. Your website matters here too, because it is often where personal data first arrives through forms and enquiries. Our web design service builds forms that collect only what you need.
For a premium website built and managed for your business, the Buzzozo website plan costs £149/mo. That is the website offer, not a quoted fee for AI consultancy. Start your free 14-day trial. No card needed.
Common questions
Is this article legal advice?
No. It explains the topic in general terms so you can ask better questions. For advice on your own situation, speak to a qualified data protection adviser or solicitor.
Can staff paste customer details into an AI tool?
Check the purpose, the lawful basis, the supplier terms and how the inputs are stored first, and confirm the approach with your adviser. Many businesses set a simple rule that identifying details are removed first.
What should I bring to an AI consultancy discussion?
Bring a description of the task, examples with personal details removed, the tools you already use and any data protection notes you have. Include the person who does the work.