Guide
AI and data protection: GDPR essentials for businesses
What UK and EU data protection law expects when you use AI chatbots, assistants and automation with customer data, including the UK's 2026 changes to automated decisions. A practical checklist.
VAULT 33|27 · Updated 12 November 2026 · Reviewed 12 November 2026 · 3 min read
Last checked: 12 November 2026. Plain-language guidance, not legal advice. The ICO has said its AI guidance is under review following the UK's 2025 data reforms, so check for updates.
The starting point
Using AI does not create a separate set of privacy rules. When a chatbot collects a customer's name, phone number or the details of their problem, that is personal data, and the same UK GDPR or EU GDPR principles apply as for a contact form. What changes is the risk: AI tools can collect more, keep more, send data to more places and make decisions faster.
Six questions to answer before you switch an AI tool on
| Question | What good looks like |
|---|---|
| 1. What personal data does it collect? | Only what you need to answer and book: no "just in case" fields |
| 2. What is your lawful basis? | Usually steps a customer asked for before a contract, or legitimate interests. Consent where the law requires it, for example many marketing messages |
| 3. Who processes the data? | Every AI provider, CRM and messaging platform named, with a data processing agreement in place |
| 4. Where does it go? | Known countries, with a recognised transfer mechanism for anything outside the UK or EEA |
| 5. How long is it kept? | A defined retention period, with deletion that actually happens |
| 6. Does the provider train its models on your data? | Off by default, or you understand and disclose it |
Telling people
Your privacy notice must explain, in plain words, that you use AI tools, what they do with personal data, and who provides them. Separately, the EU AI Act now requires that people know when they are talking to an AI system (see our EU AI Act guide). One clear line at the start of every conversation covers the practical part of both.
Sensitive information
Health details, and other special category data, need extra care. A dental tourism enquiry with X-rays, or a clinic chatbot that hears about symptoms, is handling health data. You need an additional legal condition, stronger security and tighter access. Design the assistant to collect only what is needed and to hand clinical questions to a person.
Automated decisions: the UK changed in 2026
Most enquiry assistants do not make significant decisions about people. They answer questions and book appointments. But if you use AI to decide things that seriously affect someone, such as whether to offer a service, a price or credit, the rules on automated decision-making apply.
| EU GDPR (Article 22) | UK GDPR since 5 February 2026 | |
|---|---|---|
| Approach | Solely automated decisions with legal or similarly significant effects are restricted, with limited exceptions | Replaced by new Articles 22A to 22D: allowed with safeguards for ordinary personal data |
| Special category data | Tightly restricted | Still restricted |
| Safeguards | Human intervention, the right to contest, information about the logic | Information about the decision, the ability to make representations, human intervention and the right to contest |
If you serve customers in both the UK and the EU, design for the stricter EU rule.
When you need a DPIA
A data protection impact assessment is required when processing is likely to result in a high risk to people. For a small business, the triggers are usually large volumes of sensitive data, systematic monitoring, or significant automated decisions. Even when it is not strictly required, a short written assessment of a new AI tool is good practice and good evidence.
Your checklist
- List every AI tool that touches customer data, and what it collects.
- Confirm a data processing agreement with each provider.
- Turn off model training on your data where you can.
- Update your privacy notice to describe the AI tools you use.
- Tell people at the start of every AI conversation that it is AI, and how to reach a person.
- Set retention periods and make sure deletion happens.
- Keep health and other sensitive data out of AI tools unless you have the right basis and safeguards.
- Review the setup whenever you change provider or add a channel.
Every AI enquiry assistant we build is set up this way, with EU data storage for EU clients.
Sources
Open your vault.
A free systems audit of your business: where enquiries leak and exactly what we would build.
Book your free audit