In short
DeepSeek's main security risk for UK organisations is data handling: its privacy policy says it collects, processes and stores personal data in the People's Republic of China and may use user input to train models, with an opt-out. That raises UK GDPR transfer and DPIA questions, so the realistic options are to block the consumer app or restrict it tightly.
Get a quote for AI app control for DeepSeek
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Is DeepSeek a security risk?
For a UK organisation, the question is less about DeepSeek's technology and more about where your data goes and on what terms. DeepSeek's consumer app and website are run by a company based in China, under a privacy policy that says data is stored there and that user input may be used to train its models.
That does not mean every use is a problem. It means that putting personal data, client information or anything confidential into the consumer service creates obligations and risks that your organisation, not the individual employee, carries. If staff are using it already, that is shadow AI, and it needs a decision.
We base this page on DeepSeek's own published privacy policy (last updated 10 February 2026) rather than on news reports. Check the current version before relying on it, as policies change.
What DeepSeek's privacy policy says
The points that matter most for a business, from DeepSeek's privacy policy:
| Topic | What the policy says | Why it matters to a UK organisation |
|---|---|---|
| Where data is stored | DeepSeek says it directly collects, processes and stores personal data in the People's Republic of China | Sending personal data there is an international transfer under UK GDPR |
| What is collected | User input including text, voice, prompts, uploaded files, photos, feedback and chat history, plus device, network and usage information | Anything staff paste or upload is collected, including documents and images |
| Training | User input may be used to improve its technology, including training models; users have a right to opt out | Unless each user opts out, work content may feed model training |
| Sensitive data | DeepSeek says it does not ask for sensitive personal data and users should not provide it | Special category data and confidential client material should stay out |
| Retention | Account data, including inputs, is kept for as long as the account exists, and longer in some circumstances the policy sets out | Data stays with the provider while the employee keeps the account |
| Who is responsible | The data controller is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., registered in China | Staff use of the consumer service runs on DeepSeek's own terms, not a contract your organisation has agreed |
The opt-out is a choice each user makes in their own account. Your organisation cannot set it centrally for consumer accounts, and cannot see whether people have done it.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What it means under UK GDPR
If an employee enters personal data into DeepSeek's consumer service for a work purpose, your organisation is still accountable for that processing as controller. The questions that follow are the usual UK GDPR ones, made harder by the circumstances:
- International transfer: personal data sent to a provider in China is a restricted transfer. The UK has not made adequacy regulations for China, so a transfer would need an appropriate safeguard or a valid exception, which ad hoc staff use is unlikely to have.
- Lawful basis and transparency: people whose data is entered would not normally expect it, and your privacy notice is unlikely to cover it.
- Data minimisation and security: you need to be able to show that only necessary data is shared, with appropriate security.
- DPIA: if you decide to allow any use involving personal data, a data protection impact assessment is the way to test whether the risk is acceptable.
- Confidentiality: separately from data protection, contracts with clients may forbid sharing their information with unapproved third parties.
Our guides to AI and UK GDPR and ICO AI guidance go into more depth. This is general information, not legal advice; for a specific decision, take advice and check the ICO's current guidance on international transfers.
The app versus the model
It helps to separate two things that share a name:
- DeepSeek's own app and website, run by DeepSeek under the privacy policy above. This is what staff usually mean when they say they have "tried DeepSeek".
- DeepSeek models hosted by someone else. DeepSeek has published model weights, and other AI and cloud providers offer DeepSeek models on their own platforms. In that case the hosting provider's terms, data location and security apply, not DeepSeek's consumer policy.
A model hosted by a provider you have already assessed and contracted with is a different risk from the consumer app. Assess it like any other AI service, using an AI risk assessment, rather than approving or banning by name alone.
Is AI app control for DeepSeek the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Your options: block, restrict or allow
There are three realistic positions for the consumer service:
| Option | When it fits | How to enforce it |
|---|---|---|
| Block the consumer app and website | You handle personal or client data and cannot accept the transfer and training terms | Block at the browser and on the device, and point users to an approved tool |
| Allow with tight restrictions | There is a genuine need, for example evaluating the model, with no sensitive data involved | Redact sensitive data, limit uploads and copy and paste, and log use |
| Allow a hosted model through an approved provider | Teams want DeepSeek models under contract terms you have checked | Approve the provider, not the consumer app, and keep the consumer service blocked |
Whatever you decide, write it into your AI acceptable use policy and explain why. People accept a block more readily when they know the reason and have an alternative. Staff using the DeepSeek app on personal phones sit outside technical controls on work devices, so the policy and training matter there.
Also check whether your clients, contracts or sector bodies restrict particular AI providers. Some organisations have specific requirements that go further than general UK GDPR obligations.
How to block DeepSeek at work
A web address block on its own is a start but leaves gaps, as our guide on how to block AI tools explains: it does not cover desktop apps or extensions, misses use off the corporate network unless traffic is routed back, and lists go out of date as new AI tools appear. A more complete approach:
- Find out whether DeepSeek is in use, by whom and for what, so the block does not surprise a team that relies on it.
- Offer an approved alternative with suitable data terms.
- Block the consumer service at the browser and on the device, so the block follows people working from home.
- Explain the block with a message that points to the approved tool and the policy.
- Watch for new AI apps with similar terms, so the decision applies to the category, not just one name.
How Workforce AI Security helps
Check Point Workforce AI Security is designed for exactly this kind of decision. Based on Check Point's material, it provides:
- Discovery of sanctioned and shadow AI apps, tools, extensions and agents, with session-level visibility of who uses what
- An AI application catalogue with risk scoring, which you can search for apps not yet used in your organisation, so you can set a position before people start
- Blocking of unauthorised AI apps, and per-app policies where you choose to allow restricted use
- Inline redaction of personal data, credentials, source code and financial data from prompts and uploads, including files and images using OCR
- Interactive user guidance that explains what was blocked or redacted and why
- Audit trails and reports you can use as evidence for your UK GDPR accountability
Check Point does not publish a list of every app in its catalogue, so we confirm how specific apps such as DeepSeek are identified and controlled during a pilot. Workforce AI Security Essentials covers AI used through the browser; Workforce AI Security Enterprise adds a desktop agent for desktop AI apps, coding assistants and agents. See how Workforce AI Security works.
How we help
Forever Systems can show you whether DeepSeek and similar AI apps are being used in your organisation, help you decide whether to block, restrict or allow them, and set that up with Workforce AI Security so the decision is enforced and explained to users.
To talk about DeepSeek and other unapproved AI apps, or to ask for a quote, contact us.
How Forever Systems helps you use AI safely
We are an independent UK IT and cyber security provider. We supply Check Point Workforce AI Security and help organisations put sensible, workable rules around AI at work.
- See what is really in use: we can start with a discovery pilot, so you know which AI tools, browser extensions, coding assistants and agents your people use before anyone writes rules
- Policy you can enforce: we help you decide what to approve, restrict or block, and turn your AI acceptable use policy into Workforce AI Security policies
- The right tier: Essentials for browser-based AI, Enterprise when desktop apps, developer code assistants and agents are in the picture, confirmed at quote
- Staged roll-out: from monitoring to warnings, redaction and blocking at a pace your people can absorb, with reviews along the way
- Around the tool: Microsoft 365 permissions ahead of Copilot, device management for the extension and agent, and safe use of AI training for staff
We work with businesses, schools, charities and public sector organisations. Our guides are general information, not legal advice.
Frequently asked questions
Is DeepSeek safe to use at work?
It depends on what goes into it. DeepSeek's privacy policy says personal data is collected, processed and stored in the People's Republic of China and that user input may be used for training unless the user opts out. The safe default is to keep personal, client and confidential data out of it, or to block the consumer service.
Where does DeepSeek store data?
DeepSeek's privacy policy, last updated 10 February 2026, says it directly collects, processes and stores personal data in the People's Republic of China.
Does DeepSeek use my prompts to train its models?
Its privacy policy says user input may be used to improve its technology, including training models, and gives users the right to opt out. The opt-out is set by each user, so an organisation cannot apply it centrally to consumer accounts.
Does UK GDPR allow staff to use DeepSeek with personal data?
Your organisation remains accountable as controller. Sending personal data to a provider in China is a restricted transfer, the UK has not made adequacy regulations for China, and a DPIA would normally be needed. This is general information, not legal advice.
How do I block DeepSeek on work devices?
Block the consumer app and website at the browser and on the device, not only on the office network, and explain the block with a pointer to an approved tool. Workforce AI Security can discover AI app use, block unauthorised AI apps and guide users.
Still have a question about AI app control for DeepSeek?
Ask us and a member of our team will reply by email.