AI and UK GDPR: what businesses need to know

Does UK GDPR apply to AI tools?

Yes, whenever personal data is involved. UK GDPR does not have a special chapter for AI: the same principles apply whether personal data goes into a database, an email or a chatbot. What AI changes is how easily it happens. A member of staff can paste a client's details, a disciplinary note or a customer list into an AI assistant in seconds, without anyone else knowing.

For a UK organisation, the important points are:

• You remain the controller. If staff use AI for work, your organisation decides the purpose, so it is accountable for that processing even when nobody approved the tool.
• "Processing" is broad. Typing, pasting, uploading a file, or letting an AI agent read a mailbox or a folder all count.
• Accountability means evidence. UK GDPR expects you to be able to demonstrate compliance, not just intend it. Without a record of which AI tools are in use and what data goes into them, that is hard to do.

This is why we start every AI conversation with discovery. You cannot apply the law to AI use you cannot see, and shadow AI is usually wider than people expect.

The UK GDPR principles applied to AI use

The principles in Article 5 of UK GDPR map neatly onto everyday AI risks:

Most of these controls are organisational (policy, approvals, training) and some are technical (redaction, blocking, logging). An AI acceptable use policy sets the rules; technical controls make them stick.

What role does the AI provider play?

The provider's role decides which terms protect the data, and it differs between consumer and business offerings:

• Business and enterprise plans typically come with a data processing agreement in which the provider acts as your processor, limits how it uses your data and commits to security measures. Article 28 of UK GDPR requires a contract with these terms when a processor acts on your behalf.
• Consumer and free accounts are usually run under the provider's own terms and privacy policy, often with the provider deciding how data is used, including for improving its models. Your organisation has no contract covering that use.

Before approving any AI tool, check at least: whether your data is used for training, how long prompts and files are kept, where data is processed and stored, which sub-processors are involved, and what admin controls you get. Our guides to ChatGPT security risks, DeepSeek security risks and Microsoft Copilot security look at three common cases.

Approving a business plan does not stop staff using a personal account of the same tool, or a different tool altogether. That gap is where most AI data protection problems sit.

International transfers

Many AI services process data outside the UK. Sending personal data to a provider in another country is a restricted transfer, and UK GDPR only allows it on certain terms.

The Data (Use and Access) Act 2025 reworked these rules. Since 5 February 2026, UK GDPR says a transfer may only be made if it is approved by regulations made by the Secretary of State, is made subject to appropriate safeguards (such as standard data protection clauses), or relies on a derogation for a specific situation, and that the safeguards route involves the controller considering, reasonably and proportionately, whether the "data protection test" is met.

For AI use, the practical questions are simple: where does this tool process and store data, and does the provider's contract cover transfers properly? Ad hoc use of a consumer AI app hosted abroad is hard to square with either.

Automated decisions and AI output about people

Most staff AI use is drafting, summarising and analysing, with a person making the decision. Where AI starts making decisions about people, extra rules apply.

The Data (Use and Access) Act 2025 replaced the old Article 22 with new Articles 22A to 22D, in force since 5 February 2026. In summary, a decision is "based solely on automated processing" if there is no meaningful human involvement, and a significant decision is one with a legal or similarly significant effect. Where such decisions are made, the controller must have safeguards that give people information about the decision, let them make representations, obtain human intervention and contest it. There are tighter restrictions where special category data is involved.

If AI is used in recruitment, performance management, credit or similar decisions, treat it as a high-risk use: do a DPIA, make sure human review is real rather than a rubber stamp, and document it.

What the Data (Use and Access) Act 2025 changed

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and has been brought into force in stages. Changes relevant to AI use include:

• Recognised legitimate interests: a new lawful basis in Article 6(1)(ea) for certain purposes set out in the law.
• Automated decision-making: Articles 22A to 22D replace Article 22, as described above.
• International transfers: a reworked Chapter V built around the "data protection test".
• The regulator: on 30 September 2026 the office of Information Commissioner was abolished and its functions transferred to a new body, the Information Commission. Things done by the Commissioner before then carry on as if done by the Commission.

Much of what organisations need to do about AI did not change: accountability, transparency, minimisation, security and DPIAs for high-risk processing all remain. Guidance written before these changes may refer to the old wording, so check the date of anything you rely on. Our page on ICO AI guidance explains how to use the regulator's material.

Monitoring AI use is processing too

Any tool that inspects prompts to protect data is itself processing personal data about your staff, and sometimes about the people mentioned in those prompts. Handle that properly:

• Tell staff what is monitored and why, in the AI acceptable use policy and the staff privacy notice.
• Keep it proportionate: decide what is logged, who can see it and how long it is kept.
• Assess it: a DPIA for the monitoring itself is good practice, and it sits naturally alongside the DPIA for AI use. Our sister site explains the ICO guidance on monitoring workers and the employee monitoring DPIA.

Done this way, monitoring supports compliance rather than creating a new problem. It is also easier to explain to staff when the aim is clear: to protect personal data and let people use AI safely, not to read everyone's conversations.

How Workforce AI Security supports UK GDPR compliance

Check Point Workforce AI Security does not make an organisation compliant on its own, but it provides three things that UK GDPR compliance for AI depends on.

Evidence. It discovers sanctioned and shadow AI apps, tools and MCP servers, with a breakdown by app, session and user, and classifies what prompts are used for into use-case categories. That is your AI inventory and the factual basis for DPIAs and policy decisions.

Prevention. Its context-aware data protection detects personal data, credentials, source code and financial data in prompts, uploads and attachments. Policies can redact sensitive data with labelled placeholders, redact files and images using OCR, restrict copy and paste, warn and guide the user, or block an unapproved AI app. It can apply different policies to managed (corporate) and unmanaged (personal) accounts of the same tool.

Audit trail. Check Point says its audit trails and customisable reports support compliance work for GDPR, HIPAA and the EU AI Act.

The Essentials tier covers AI used in web applications; the Enterprise tier adds desktop AI apps, coding assistants and AI agents. See how Workforce AI Security works for the detail.

How Forever Systems helps

We help UK organisations get AI use under control and keep the records to show how:

1. Discovery first: a pilot of Workforce AI Security in discovery mode to show which AI tools are in use, by whom and with what kinds of data.
2. Policy: turning what discovery shows into an AI acceptable use policy and approved-tool list your DPO or legal adviser can sign off.
3. Controls: configuring redaction, warnings and blocks that match the policy, starting gently and tightening as people adapt.
4. Evidence: reports and audit trails you can use in DPIAs, audits and client questionnaires.

We are a technology supplier, not a law firm, so we work alongside your DPO or legal adviser rather than replacing them. Staff training on data protection is covered by our sister site's GDPR training for staff.

This page is general information, not legal advice. Data protection law changed in 2025 and 2026, so check the regulator's current guidance and take advice for specific decisions. Contact us to start with discovery.