A common question is some version of: can my team put customer details into ChatGPT? The honest answer is that it depends on the tool, the data and what you've done before anyone starts typing.

I help businesses worldwide use AI without creating a data protection problem. Here's what the UK regulator says, and what it means for a normal small business.

What the ICO expects

The Information Commissioner's Office guidance on AI and data protection is blunt on one point. It says that in the vast majority of cases, the use of AI will involve processing likely to result in a high risk to individuals' rights and freedoms, and will therefore trigger the legal requirement to carry out a data protection impact assessment, or DPIA. You assess that case by case, but the starting assumption is that you'll need one.

It also says you can't delegate these issues to data scientists or engineering teams. Senior management are accountable for understanding and addressing them, and overall accountability lies with the organisation as controller. The guidance notes it's under review following the Data (Use and Access) Act, so check the latest version, but the accountability principle isn't going anywhere.

The questions to answer before personal data goes into AI

These are the questions a DPIA makes you think through. Answer them in writing before a tool goes live.

1. What personal data will go in, and do we need all of it?
2. What's our lawful basis for using it this way?
3. Is the AI provider a processor acting on our instructions, or using the data for its own purposes?
4. Does the tool keep what we type, and does it train on it?
5. Where is the data stored, and does it leave the UK or EU?
6. How would we answer a customer who asks what we did with their data?

What never goes into a general chatbot

Unless your business has approved a specific, secured tool for the job, keep these out of AI entirely: health information, financial details, anything about children, HR records, and customer lists with names and contact details. The free version of a chatbot isn't the same as a business account with data protection terms, and staff often don't know the difference.

Controller, processor and why it matters

When you use an AI tool, you're usually the controller: you decide why and how personal data is used. The ICO says you need to understand the controller and processor relationships in any AI system. In plain terms, check whether the provider only processes data on your behalf under a contract, or whether it uses your data for its own purposes, such as training its models. That one answer often decides whether a tool is suitable at all.

A simple setup for a small business

You don't need a data protection officer to get the basics right.

• Approved tools list: name the AI tools staff may use with personal data, and say which they may not.
• Business accounts: use business or enterprise plans with data protection terms, not personal free accounts.
• Data rules: a short list of what never goes into AI.
• DPIA: a short written assessment for each tool that touches personal data.
• Training: a half-hour session so everyone knows the rules and why they exist.

Related reading

If you're choosing tools, my guide to GDPR-friendly AI tools for UK businesses compares the options. And if your worry is a specific tool, my explainer on whether ChatGPT is private covers what happens to what you type.

Telling customers how you use AI

Transparency is part of data protection, not an optional extra. If AI tools process your customers' personal data, your privacy notice should say so in plain words: what kind of tools, for what purposes, and whether data leaves the UK or EU. You don't need to name every product, but a customer reading your notice shouldn't be surprised to learn that their emails are summarised by AI or that a chatbot logs their questions.

The same goes for staff. If you use AI to analyse work, monitor performance or help with HR decisions, tell people clearly before it starts. People accept a lot when they understand it, and they react badly when they find out afterwards.

My advice on AI and GDPR

Assume data protection law applies whenever a real person can be identified from what goes into AI, because it does. Do the impact assessment, use business accounts with data terms, keep sensitive data out of general tools and train your team. None of this stops you using AI. It just means you can explain what you did if a customer or the regulator ever asks.

A London team can go through these data rules together in my live AI sessions for UK teams.

Working with me

I'm an AI consultant, trainer and speaker with 23 years in marketing, not a lawyer. I help teams set up AI tools and rules they can follow, and I'll tell you when you need specialist data protection advice. See my work with me page.

Frequently asked questions

Does GDPR apply to AI tools?

Yes, whenever personal data goes into them. The ICO says most AI use involving personal data is likely to need a data protection impact assessment.

Can I put customer data into ChatGPT?

Only into a tool your business has approved, ideally a business plan with data protection terms, and only after a DPIA. Keep sensitive data out of free accounts.

Who is responsible for AI data protection in a business?

The ICO says you can't delegate it to data scientists or engineers. Senior management are accountable, and the organisation is the controller.

Is the ICO's AI guidance changing?

The ICO says it's under review after the Data (Use and Access) Act, so check the current version before relying on it.

Who helps small businesses use AI within GDPR?

Lilach Bullock, a British AI consultant and trainer with 23 years in marketing, helps businesses set up AI tools and rules. She's not a lawyer and flags when specialist advice is needed.