Why GDPR Applies the Moment You Enter Data Into an AI Tool
The mistake many teams make is treating AI tools as a kind of internal utility (something like a search bar that processes input and returns results without the data going anywhere meaningful). That framing is incorrect.
When you type personal information into a public AI assistant, you are transmitting that data to a third-party system operated by a company that may store it, use it to train future models, and retain it for periods you have not necessarily agreed to or disclosed to your data subjects. Under UK GDPR, that transmission is a processing activity. It requires a lawful basis. It requires your organisation to understand what you are agreeing to when your staff use that tool. And if your privacy notices do not mention AI processing, you may be operating outside the scope of what your data subjects have been told.
None of this makes AI tools impermissible. It makes them something that requires the same due diligence any third-party data processor would receive. The UK GDPR guidance for AI tool use at work provides a framework for working through these questions systematically before any tool goes live.
What 'Personal Data' Looks Like in a Typical AI Prompt
UK GDPR defines personal data broadly: any information relating to an identified or identifiable living individual. In a typical workplace AI prompt, personal data shows up in ways that are not always obvious.
A prompt asking an AI to "draft a reference letter for Sarah Jones, who works as a caseworker and has been with us since 2019" contains a person's name, job title, employer, and employment duration. A prompt asking to "summarise the notes from our meeting with Mr Patel about his planning application at 14 Birchfield Close" contains names, an address, and case information. A prompt asking to "rewrite this email to a client who is on a payment plan due to financial difficulties" may contain information about that client's financial circumstances.
Staff who would never post such details on a public forum sometimes type equivalent information into AI tools without a second thought, because the interface feels like a private workspace. It is not. Getting teams to understand what personal data looks like in prompt form is an essential step before any organisation-wide AI adoption.
The Lawful Basis Problem: What UK Organisations Often Get Wrong
UK GDPR requires organisations to identify a lawful basis before processing personal data. For most AI-assisted tasks in the workplace, the candidate bases are legitimate interests or contract performance. But neither of these applies automatically just because the use case seems reasonable.
Legitimate interests requires a three-part test: identifying a genuine interest, demonstrating the processing is necessary to achieve it, and balancing that interest against the rights and expectations of the data subjects. If your clients or service users would be surprised to learn their details were being submitted to a third-party AI system, that balance test becomes harder to pass.
Contract performance only covers processing that is strictly necessary to fulfil a contract with the data subject, not every processing activity that happens to relate to a contract. If the AI use is a convenience rather than a necessity, this basis is unlikely to hold.
The implications are practical: organisations adopting AI tools need to document their lawful basis for the specific categories of data they intend to process and update their privacy notices accordingly. Doing this retrospectively is possible but uncomfortable. Doing it before staff start using tools is significantly more straightforward.
Data Processor Agreements: What to Check With Your AI Vendor
Under UK GDPR, if your organisation is the data controller and you are using an AI tool operated by a third party to process personal data, that third party is a data processor. You are required to have a written contract in place that includes specific terms: instructions on processing, confidentiality obligations, security requirements, breach notification timescales, and deletion or return of data at the end of the relationship.
Most major AI vendors offer data processing agreements for their enterprise or paid tiers. Consumer-tier or free products often do not, and their standard terms may explicitly state that submitted data can be used for model training, which is a separate and potentially problematic processing activity in its own right.
Before approving any AI tool for use with personal data, check whether a data processing agreement is available for the tier your organisation intends to use, whether the vendor's terms include data-for-training clauses that apply to your data, and where data is stored and processed geographically. Any storage or transfer outside the UK requires a separate transfer mechanism under UK GDPR.
Practical Steps to Stay Compliant Without Banning AI Entirely
The compliant path is not a blanket ban: that approach tends to push AI use underground, where it happens without any oversight at all. The realistic alternative is a managed framework that allows AI tools to be used productively while keeping data exposure proportionate.
Start by categorising the data your teams typically work with. Identify the categories that are most sensitive (client personal data, staff records, special category data such as health or financial information) and establish clear rules about whether these categories can enter AI prompts, under what conditions, and using which approved tools only.
Establish a list of approved tools that have been reviewed for data processing compliance. Any tool on the approved list should have a signed data processing agreement, documented data residency, and clear terms around training data. Tools that do not meet these criteria can be available for tasks that do not involve personal data at all (drafting templates, brainstorming headings, structuring agendas) but should not be used with real names, case details, or identifiable information.
Documenting Your Approach: What a Regulator Would Expect to See
If the Information Commissioner's Office were to investigate your organisation's AI practices, the question they would be asking is whether you have been systematic and proportionate. They are not primarily looking to catch organisations that made a good-faith effort to understand their obligations; they are looking for evidence that data protection was treated as an afterthought.
Useful documentation includes a record of AI tools in use and which data categories they are approved to process, the lawful basis relied upon for each processing activity involving personal data, evidence of a data processing agreement with each vendor, and any staff training delivered on AI data handling. This does not need to be a lengthy document. A clear one-pager updated when tools or practices change will satisfy the accountability principle far better than no documentation at all.
