The AI Barn

AI and UK GDPR for small businesses: what to check before you paste customer data

By Rob Falconer Published Updated

Not legal advice. This is a practical summary of guidance from the Information Commissioner’s Office (ICO) and providers’ own documents, checked 24 October 2026. Data protection law is changing under the Data (Use and Access) Act 2025, and the ICO says its AI guidance is under review. For anything high-risk, get advice from a qualified data protection professional.

Why this matters for a small business

It’s easy to paste a customer’s complaint email into a chatbot and ask for a polite reply. If that email has a name, an address, an order history or a health detail in it, you’re processing personal data. UK GDPR applies just as it does in your inbox or your CRM.

The ICO is clear: “There is no ‘AI exemption’ to data protection law.” It also warns businesses not to think only about “personally identifiable information”, because the legal definition of personal data is wider (ICO, Tackling misconceptions, checked 24 Oct 2026).

Six questions before you paste customer data into a chatbot

1. Do you need the personal data at all?

Usually you don’t. Swap names for “Customer A”, remove order numbers, addresses and phone numbers, and ask the AI to work on the cleaned-up text. UK GDPR’s data minimisation principle means you should only use the personal data you actually need (ICO, Data minimisation, checked 24 Oct 2026).

2. Which plan are you on, and what does the provider do with your inputs?

Consumer and business plans often treat your data differently. For example, OpenAI says content from ChatGPT Free, Go, Plus and Pro may be used to train its models unless you switch off “Improve the model for everyone” in Settings > Data controls. It says it doesn’t train on ChatGPT Business, Enterprise or API data by default (OpenAI Help Centre, checked 24 Oct 2026). Check the equivalent page for whichever tool you use, and don’t let staff use personal accounts for customer work.

3. Is there a data processing agreement?

If the AI provider processes personal data on your behalf, it’s usually your processor, and the ICO says you must have a written contract with it (ICO, Contracts, checked 24 Oct 2026). Many providers call this a data processing agreement or addendum (DPA). OpenAI, for example, says it can sign a DPA for its business products (OpenAI business data, checked 24 Oct 2026). The ICO lists what the contract has to cover, including:

  • processing only on your documented instructions
  • a duty of confidentiality for the people handling the data
  • appropriate security measures
  • using sub-processors only with your authorisation
  • helping you with people’s rights requests, security, breaches and impact assessments
  • deleting or returning the data when the contract ends
  • allowing audits and giving you the information you need to show compliance

Free consumer sign-ups often don’t come with a DPA. That’s one reason they’re a poor fit for customer data.

4. Where does the data go?

Many AI tools process data in the US. Sending personal data outside the UK is a “restricted transfer” and needs a lawful route, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies) or safeguards like the ICO’s International Data Transfer Agreement (ICO, A brief guide to international transfers, checked 24 Oct 2026). The provider’s DPA should say which route it relies on. Some business plans also offer UK data residency. OpenAI says this is available to eligible Enterprise, Edu and API customers.

5. Is any of it special category data?

Health information, ethnicity, religion, sexual orientation and similar details are special category data, and you need an extra condition to process them (ICO, Special category data, checked 24 Oct 2026). A simple rule: keep this kind of data out of general-purpose chatbots altogether unless you’ve had advice.

6. Would your customers expect it, and have you told them?

The ICO warns that something being “common practice” doesn’t mean it meets people’s reasonable expectations. If you use AI tools with customer data, say so in your privacy notice, and name the type of provider and the purpose.

What the ICO’s AI guidance covers

The ICO’s Guidance on AI and data protection (checked 24 Oct 2026) is written mainly for organisations building or buying AI systems, but its main themes apply to small users too:

  • Accountability: be able to show how you decided an AI use was appropriate. For higher-risk uses, that means a data protection impact assessment (DPIA) (ICO, DPIAs).
  • Transparency: tell people how their data is used.
  • Lawfulness, accuracy and fairness: have a lawful basis, check outputs for errors, and watch for bias. AI tools can produce confident-sounding mistakes about real people.
  • Automated decisions: extra rules apply when decisions with legal or similarly significant effects are made without meaningful human involvement. Hiring and credit decisions are typical examples. Keep a person genuinely in the loop.

The ICO notes that this guidance is under review because of the Data (Use and Access) Act 2025, so check the page for updates. The ICO also has a hub for small organisations.

A simple checklist

  • We’ve listed which AI tools staff use and what data goes into each one.
  • Customer data only goes into business-plan accounts that the business controls, not personal accounts.
  • Training on our inputs is switched off where the plan allows it, or doesn’t happen by default.
  • We have the provider’s DPA, and we know where it processes data and which transfer route it uses.
  • Staff remove names and identifiers before pasting, wherever they can.
  • No special category data goes into general chatbots without advice.
  • A person checks AI output before it goes to a customer or affects a decision about someone.
  • Our privacy notice mentions AI tools and why we use them.
  • We’ve considered a DPIA for anything higher-risk.
  • Accounts are protected with strong passwords and two-factor authentication.

FAQ

Can I use free ChatGPT for customer emails?

For text with the customer details removed, the risk is much lower. For anything containing personal data, a business plan with a DPA and training switched off by default is the safer choice.

Do I need a DPIA just to use a chatbot?

Not always. A DPIA is required for processing that’s likely to be high-risk, for example large-scale use of sensitive data or decisions about people. The ICO’s DPIA guidance includes a screening checklist.

Sources

All checked 24 October 2026. Guidance changes, so check the current version.

Get new guides by email

New guides, UK price changes and reality checks on AI tools, sent when there’s something worth reading.

Sign up to the newsletter