UK GDPR and AI tools: a practical checklist for small organisations

If you put personal data into an AI tool, UK GDPR applies just as it does to your email or your CRM. There’s no AI exemption, and no need to panic. For most small organisations the job is ordinary data protection work, done properly for one more set of tools: a lawful basis, a risk assessment, an honest privacy notice, a proper contract and clear rules for staff. Two changes arrived in 2026, and there’s a checklist at the end.

Start with a lawful basis

Every use of personal data needs a lawful basis under Article 6 of UK GDPR, and that includes pasting a client’s email into a chatbot. Decide it for each purpose, not each tool: summarising case notes and screening job applicants are different purposes.

For everyday business uses the usual candidates are contract, legal obligation and legitimate interests. If you rely on legitimate interests, write down why the use is needed and why it’s fair to the people whose data it is. Health, ethnicity, religion and the other special categories need an extra condition, so take more care there.

Watch reused data: feeding years of client files into a new AI tool is a new use, so check it fits with what you told people.

Do a DPIA before you start

A data protection impact assessment (DPIA) is a written look at what could go wrong for the people whose data you use, and what you’ll do about it. Article 35 requires one when processing is likely to be high risk, and the ICO is blunt about AI: “in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms”.

A small organisation’s DPIA can be short. Describe what data goes in, where it goes, who sees the output and what decisions it feeds. List the risks (wrong answers, leaks, unfair outcomes) and what reduces each. The ICO’s DPIA guidance walks through it. Revisit yours when the tool or the use changes.

Tell people what you’re doing

People have a right to know how you use their data, so update your privacy notice: say you use AI tools, what for, who provides them and how long data is kept. Tell people about new uses before you start, not after. If AI plays a part in significant decisions about people, the ICO says to “tell them what information you use, why it is relevant and what the likely impact is going to be”.

Choose tools you can answer for

Many AI tools come in consumer and business versions with different terms. Don’t rely on what a tool did last year: read the current terms for the plan you’ll actually use, and answer five questions:

1. Is there a business plan with data processing terms?
2. Where is your data stored and processed? If it leaves the UK, the international transfer rules apply.
3. Are your inputs and outputs used to train the provider’s models, and can you switch that off?
4. How long are prompts, files and outputs kept, and can you delete them?
5. Can you control who has access, and turn on multi-factor authentication?

If you can’t tell whether a third-party tool would be compliant, the ICO’s advice is to pick a different one. Our guide to choosing an AI assistant for your team covers the practical side.

Get the contract right

When an AI provider processes personal data on your behalf, it’s your processor, and Article 28 requires a written contract. For most AI tools that’s the provider’s data processing terms, so read them and keep a copy. They should cover acting only on your documented instructions, confidentiality, security, sub-processors, help with people’s rights requests, audits, and deleting or returning data at the end. Roles aren’t always that simple (an organisation can be a processor for some purposes and a controller for others), so the ICO says to document the role of each organisation you work with.

Set rules for your team

Many problems start with a well-meaning person and a free account. A few written rules prevent most of them:

• Use approved tools only, on work accounts.
• Keep sensitive data out of any tool that isn’t approved for it.
• A person checks every output before it’s sent or acted on.
• Tell your data protection lead before starting a new use.
• Report mistakes quickly, without blame.

There’s more in an AI policy your team will read. If software takes actions on its own, organisations “remain responsible for data protection compliance of the agentic AI they develop, deploy or integrate”, says the ICO.

What changed in 2026

Automated decisions, from 5 February 2026

The Data (Use and Access) Act 2025 replaced Article 22 with new Articles 22A to 22D. Solely automated decisions with legal or similarly significant effects, such as rejecting a job applicant, used to be generally prohibited, with exceptions. Now they’re allowed with safeguards: you must give people information about the decision, let them make representations, offer human intervention and let them contest it. Stricter rules apply where special category data is involved.

A decision is solely automated if there’s no “meaningful human involvement”, so someone clicking “approve” on whatever the system suggests is unlikely to count. A real reviewer needs the time, information and authority to disagree.

Complaints, from 19 June 2026

You must now help people complain about how you use their personal data, for example with a complaint form that can be completed electronically. Acknowledge each complaint within 30 days, take appropriate steps to respond, and tell the person the outcome without undue delay. This covers all data protection complaints, not just AI ones.

Guidance still moving

The ICO’s guidance on AI and data protection (last updated in March 2023) is under review because of the new Act. The ICO expects to publish final guidance on automated decision-making in winter 2026, and since 12 May 2026 it has had to prepare a statutory code of practice on AI and automated decision-making.

The checklist

1. List every AI tool in use (including free ones staff signed up for), what personal data goes into each and whose it is.
2. Record a lawful basis for each purpose.
3. Do a DPIA before any new use, and review it when things change.
4. Update your privacy notice before a new use starts.
5. Use business accounts, and check the terms on storage, retention, training and transfers.
6. Keep a copy of the data processing contract.
7. Turn on access controls and multi-factor authentication.
8. Give staff short written rules, including that a person checks every output.
9. Build safeguards and real human review into significant automated decisions.
10. Have a complaints route, and acknowledge complaints within 30 days.

For the connected apps and agents on that list, is your agent stack safe? is the next check.