If you put personal data into an AI tool, UK GDPR applies exactly as it did before. The ICO’s position is simple. You need a lawful basis, you must tell people what you are doing, and where the use is high risk you must complete a data protection impact assessment before you switch it on. Most of the trouble small firms get into comes from staff pasting customer data into tools nobody has checked, not from anything exotic.
Here is what actually applies, without the legal fog, with the questions I ask a business that wants to use AI without ending up in a complaint. This is practical guidance, not legal advice, and your data protection adviser should see anything you rely on.
The thing most firms get wrong first
They think of AI as a new category with new rules. It is not. Putting a customer’s details into an AI tool is processing personal data. Asking an AI to analyse your client list is processing personal data. Letting a tool draw conclusions about a person from their history is processing personal data, and the conclusion itself is personal data too.
So every question you would ask about a new spreadsheet or a new CRM applies to the AI tool. Why do we have this data. Are we allowed to use it this way. Have we told people. Who else sees it. How long do we keep it. The tool does not change the questions. It changes how easy it is to forget them.
The three things the ICO expects
A lawful basis, as always. Using AI does not change the rules on why you may process someone’s data. If you did not have a basis to analyse a customer’s details yesterday, a clever tool does not give you one today. Inferences an AI makes about a person are personal data too, so they need a basis of their own. If the tool decides a customer is ‘high risk’ or ‘likely to churn’, that label is personal data about them.
Transparency before processing. People must be told what you are using their data for, how long you keep it, and who it is shared with, before the AI touches it. If a tool sends their data to a third party to process, that is a share, and it belongs in your privacy notice. Most SME privacy notices were written before AI and say nothing about it. That is a gap.
A DPIA where the risk is high. The ICO is clear that a data protection impact assessment is mandatory where AI processing is likely to create a high risk to individuals, and that it must be completed before deployment, not after. The assessment should show you considered less intrusive ways to achieve the same goal and why you rejected them. Profiling customers, screening job applicants, making decisions about people’s money or access to a service, these are the kinds of use that trip the high-risk threshold.
What changed in 2026
Automated decision-making has a new legal footing. From 5 February 2026 the Data (Use and Access) Act 2025 replaced the old Article 22 with Articles 22A to 22D of UK GDPR. They cover any decision made solely by automated processing that has a legal or similarly significant effect on someone, such as a credit decision, a hiring screen or a decision to refuse a service.
The practical effect is that if an AI makes a decision about a person rather than a recommendation to a person, you need safeguards. The right to be told, the right to ask for a human to look at it, and the right to challenge it. A recommendation that a human reviews and decides on is a different matter, and the distinction matters, so be honest about which you are running.
The ICO consulted on fresh guidance for this in spring 2026 and has also opened a call for evidence on the risks of agentic AI, where tools act on their own. If your AI makes decisions about people, or acts on their data without a person in the loop, this is the area to watch over the next year.
What this looks like in a real business
A 60-person recruitment firm starts using an AI tool to screen CVs. Before anything else, three questions. Is the tool making the shortlisting decision, or recommending to a consultant who decides. What data goes to the tool’s provider, and does the provider train on it. Have candidates been told.
In this case the tool was making the first cut on its own, which is an automated decision with a significant effect. So a DPIA was needed before it went live, the process was changed so a consultant reviews every rejection, the privacy notice was updated to say AI is used in screening, and the provider’s terms were checked to confirm candidate data is not used for training. Two days of work. Without it, the firm was one complaint away from an ICO conversation.
Contrast that with a 20-person consultancy using an AI tool to draft internal reports from its own anonymised project notes. No personal data goes in. No DPIA needed. A short policy on what can and cannot be pasted, and the job is done. The difference is entirely about whether personal data is involved and what the tool does with it.
The practical version for a small firm
Know which tools your staff actually use, including the free ones. Ask. The list is always longer than the leadership thinks.
Decide which categories of data may go into each, and write it down in a short policy. Public information, internal non-personal information, personal data, special category data. Most tools should be allowed the first two and nothing else.
Check each tool’s terms for whether your data is used to train it or shared on. Business tiers of the major tools usually say no. Free tiers often say yes.
For any use that profiles people or makes decisions about them, do the DPIA first and keep it. Our AI risk assessment approach is a lightweight way to work out which uses need one.
Add the AI uses to your privacy notice. A paragraph is usually enough.
Name one person who owns all of this. None of it needs a compliance department. It needs an afternoon and someone accountable.
The honest risk
The real exposure for most SMEs is leakage, a customer list or a contract pasted into a public tool by someone trying to be helpful. That is a breach, and it is the ICO’s most common AI complaint in practice. It is also entirely preventable with a clear AI acceptable use policy that staff will actually follow, and our AI governance work sets the rest up without the paperwork mountain.
The second exposure is the automated decision nobody realised was automated. The tool that quietly rejects, ranks or flags people, with no human looking. Find those and put a person back in the loop.
The common mistakes
Assuming the tool’s provider has handled compliance. They have handled theirs. Yours is yours.
Updating the policy but not training people. A policy nobody has read protects nobody.
Doing the DPIA after launch. The ICO expects it before, and a retrospective one looks like what it is.
Treating free tools as harmless. The free tier is usually where the data goes to train the model.
Frequently asked questions
Does UK GDPR apply to AI tools?
Yes, in full. Putting personal data into an AI tool is processing, so you need a lawful basis, you must be transparent, and high-risk uses need a DPIA before deployment.
When do I need a DPIA for AI?
When the processing is likely to create a high risk to individuals, such as profiling, large-scale analysis or decisions about people. The ICO expects it to be done before the system goes live.
Can staff use ChatGPT with customer data?
Only within rules you have set. Many public tools retain or train on inputs, so pasting customer data into them can be a breach. A short acceptable use policy settles what may go where.
Is an AI recommendation the same as an automated decision?
No. If a person reviews the recommendation and makes the decision, the automated decision-making rules do not apply in the same way. If the tool decides on its own with a significant effect on someone, they do. Be honest about which you are running.
Do I need to tell customers we use AI?
If their personal data goes into an AI tool, yes. Your privacy notice should say what the AI is used for, how long data is kept and who it is shared with, including the tool’s provider.
What changed for automated decisions in 2026?
The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D from 5 February 2026. If an AI makes decisions with significant effects on people, the new rules and the ICO’s updated guidance apply.