Before you connect an AI tool to customer data, check that you have a lawful basis, that your privacy notice tells people, that the supplier's terms protect the data and say whether it's used for training, and that a person stays in charge of significant decisions. If the use is likely to be high risk, do a data protection impact assessment first; the Data (Use and Access) Act 2025 changed some of the rules, but these basics still apply.
What's changed in 2026
UK GDPR and AI tools have been a confusing mix for small firms, and the law moved recently. The Data (Use and Access) Act 2025 became law in June 2025, and most of its data protection changes came into force on 5 February 2026. The ICO says on its Data (Use and Access) Act page that all of the Act's data protection and PECR provisions are now in force.
The changes most relevant to AI, as summarised in the gov.uk factsheet:
- Automated decisions. Significant decisions about people made solely by automated means are now allowed in more situations than before. In return you must tell people about the decision, let them put their side and challenge it, and give them a way to get a human to look again. Decisions using special category data, such as health information, remain more tightly restricted.
- Recognised legitimate interests. A short list of purposes, such as preventing crime, safeguarding and emergencies, no longer needs the usual balancing test. Everyday business uses like marketing still do.
- Subject access requests. Your searches need to be reasonable and proportionate, and the clock can pause while you wait for clarification.
- Complaints. You now need a clear way for people to complain to you about how you use their data.
The ICO's main guidance on AI and data protection is marked as under review because of the Act, and it consulted on new automated decision-making guidance earlier this year. Until the final versions land, use the checklist below and recheck the ICO pages before you go live.
The checklist
Work through these for each AI tool or use. Say you run a 12-person dental practice and want an AI assistant to draft replies to patient emails. I'll use that as the example throughout.
1. What personal data is involved? List it. For the dental practice: names, contact details and, almost certainly, health information in some emails. Health data is special category data, which raises the bar for everything that follows.
2. What's your lawful basis? For most business uses, it's legitimate interests or contract. Write down which, and why. The ICO's lawful basis guidance has an interactive tool. For special category data you need an extra condition as well.
3. Do you only use what you need? Can the tool do its job with less? The dental practice could strip out treatment details before the draft, or only let the assistant see the email, not the patient record.
4. Have you told people? Update your privacy notice to say you use AI tools to help with this task, what data is involved and who the supplier is.
5. What does the supplier do with the data? Read the terms. You want a data processing agreement, clear security commitments, and an answer on whether your data is used to train their models. Use business accounts with training switched off where you can, never personal free accounts.
6. Where is the data stored? If it leaves the UK, the transfer needs a legal route, such as a UK adequacy decision or the UK addendum to standard contractual clauses. The ICO's guidance on international transfers explains the options.
7. Is it secure? Company accounts, two-factor authentication, access only for those who need it, and removed promptly when someone leaves.
8. Can you handle people's rights? If a patient asks for their data or wants it corrected, can you find what went into the tool? Know where it's logged.
9. Is a person making the significant decisions? If the tool's output could significantly affect someone, such as refusing a booking, setting a price or deciding a complaint, keep a person making the final call. If you do want fully automated decisions, you'll need the new safeguards in place, and with special category data the restrictions are tighter. My list of decisions you shouldn't hand over to AI is a good guide to where the line sits.
10. Do you need a DPIA? If the use is likely to be high risk to people, for example new technology processing health data, you must do a data protection impact assessment before you start. The ICO's DPIA guidance includes a template. For the dental practice, with health data in the emails, I'd do one.
11. What happens if it goes wrong? Know who decides whether something is a reportable breach, and that serious ones go to the ICO within 72 hours of becoming aware.
Make it routine
Write down your answers, one short page per tool. That's your record if a customer or the ICO asks. Then build the answers into your AI use policy, so the team knows which tools are approved and what data can go in. Our AI policy template for small businesses shows what to cover.
And test the tool with made-up data before real customer data goes near it, as set out in how to test an AI agent before it talks to a customer. For more on where AI fits, see all our guides.
Questions people ask
Does UK GDPR apply to AI tools like chat assistants?
Yes, whenever personal data goes into them. That includes pasting a customer's email into a chat tool. The usual rules on lawful basis, transparency, security and suppliers apply.
What did the Data (Use and Access) Act 2025 change for AI?
Mainly the rules on automated decision-making: solely automated significant decisions are allowed in more situations, with safeguards such as telling people, letting them challenge the decision and offering human review. Special category data stays more restricted.
Do I need a DPIA to use AI?
Not always. You need one when the processing is likely to be high risk, which is more likely with sensitive data, new technology or decisions that significantly affect people. If in doubt, do one; it's also a good thinking tool.
Which UK GDPR and AI tools checks matter most for a small business?
Lawful basis, your privacy notice, the supplier's terms and training settings, where the data is stored, and keeping a person on significant decisions.