--- title: "AI Tools and GDPR: What to Know Before You Deploy" description: "Deploying an AI tool? Here’s what UK GDPR expects first: personal data, processor terms, lawful basis, Article 22 and when you’ll need a DPIA, explained." image: https://resources.trustkeith.co/hubfs/Resources%20Card%20template%2c%20Guides%20(56).png --- [![642bcbad7735490755580d8d\_trust-keith-logo](https://resources.trustkeith.co/hubfs/642bcbad7735490755580d8d_trust-keith-logo.svg "642bcbad7735490755580d8d_trust-keith-logo")](https://www.trustkeith.co/) - Product - [Privacy OS](https://www.trustkeith.co/product/privacy-os) - [Dedicated DPO](https://www.trustkeith.co/product/dedicated-dpo) - [Automated Data Discovery](https://www.trustkeith.co/product/automated-data-discovery) - [Intelligent Workflows](https://www.trustkeith.co/product/intelligent-workflows) - [Staff Training](https://www.trustkeith.co/product/staff-training) - [Global Risks & Controls](https://www.trustkeith.co/product/global-risks-controls) - [Proportional Policies](https://www.trustkeith.co/product/proportional-policies) - [Monitoring & Reporting](https://www.trustkeith.co/product/monitoring-reporting) - Solutions - [By Industry](https://www.trustkeith.co/solutions/industry) - [By Team](https://www.trustkeith.co/solutions/team) - [By Use Case](https://www.trustkeith.co/solutions/use-case) - [By Privacy Regulation](https://www.trustkeith.co/solutions/regulations) - [How it works](https://www.trustkeith.co/how-it-works) - [Customers](https://www.trustkeith.co/customers) - [Pricing](https://www.trustkeith.co/pricing) - [Resources](https://resources.trustkeith.co) - [Company](https://www.trustkeith.co/company) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) [![Trust Keith](https://resources.trustkeith.co/hs-fs/hubfs/raw_assets/public/Trustkeith_March2023/images/trust_keith.png?width=500&name=trust_keith.png "Trust Keith")](https://www.trustkeith.co/) - Product - [Privacy OS](https://www.trustkeith.co/product/privacy-os) - [Dedicated DPO](https://www.trustkeith.co/product/dedicated-dpo) - [Automated Data Discovery](https://www.trustkeith.co/product/automated-data-discovery) - [Intelligent Workflows](https://www.trustkeith.co/product/intelligent-workflows) - [Staff Training](https://www.trustkeith.co/product/staff-training) - [Global Risks & Controls](https://www.trustkeith.co/product/global-risks-controls) - [Proportional Policies](https://www.trustkeith.co/product/proportional-policies) - [Monitoring & Reporting](https://www.trustkeith.co/product/monitoring-reporting) - Solutions - [By Industry](https://www.trustkeith.co/solutions/industry) - [By Team](https://www.trustkeith.co/solutions/team) - [By Use Case](https://www.trustkeith.co/solutions/use-case) - [By Privacy Regulation](https://www.trustkeith.co/solutions/regulations) - [How it works](https://www.trustkeith.co/how-it-works) - [Customers](https://www.trustkeith.co/customers) - [Pricing](https://www.trustkeith.co/pricing) - [Resources](https://resources.trustkeith.co) - [Company](https://www.trustkeith.co/company) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) ![Menu Icon](https://resources.trustkeith.co/hubfs/raw_assets/public/Trustkeith_March2023/images/icon-menu.svg) ![Menu close](https://resources.trustkeith.co/hubfs/raw_assets/public/Trustkeith_March2023/images/icon-x.svg) ![](https://resources.trustkeith.co/hubfs/Resources%20Card%20template%2c%20Guides%20(56).png) # AI Tools and GDPR: What Your Business Needs to Know Before Deploying Published by [Trust Keith](https://resources.trustkeith.co/author/trust-keith) on Oct 12, 2026, 9:55:56 AM **Quick answer:** Before you deploy any AI tool that touches personal data, you need clear answers to five questions. What personal data goes in? Is the provider your processor? Which lawful basis covers the use? Does the tool make solely automated decisions about people? And does it need a DPIA? If you can't answer all five, the tool isn't ready to go live. Get them written down before launch, not after. **Contents** - •  [What Counts as Personal Data When You Use AI](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#what-counts-as-personal-data-when-you-use-ai) - •  [Is Your AI Provider a Data Processor?](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#is-your-ai-provider-a-data-processor) - •  [Which Lawful Basis Covers Your Use of AI?](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#which-lawful-basis-covers-your-use-of-ai) - •  [Automated Decision-Making and Article 22](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#automated-decision-making-and-article-22) - •  [When an AI Tool Needs a DPIA](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#when-an-ai-tool-needs-a-dpia) - •  [Employee Data and AI Tools](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#employee-data-and-ai-tools) - •  [What the ICO Expects From AI Use](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#what-the-ico-expects-from-ai-use) - •  [Frequently Asked Questions](https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#faq) --- ## **What Counts as Personal Data When You Use AI** Here's a scenario you'll recognise. Someone on your team pastes a customer email into an AI tool to "tidy up the wording". Quick, harmless, done in ten seconds. Except personal data has just been processed. Every time. Personal data is any information that relates to an identifiable person. That's wider than most people expect. Names and email addresses, yes. But also job titles combined with company names, IP addresses, voice recordings, photos, device identifiers, and anything else that points back to a real human. With AI, personal data tends to show up in three places: - **Inputs**, the prompts, documents, call recordings and spreadsheets people feed into the tool. - **Training or fine-tuning data**, if you're building or customising a model on your own records. - **Outputs**, including summaries, scores, predictions and inferences about named individuals. An AI-generated note saying a candidate "seems disengaged" is personal data about that candidate. Special category data needs extra care. Health information, biometric data, data revealing ethnicity or beliefs: if it can end up in the tool, the bar goes up. A transcript of a wellbeing call, for example, is a very different thing to a marketing email. And don't lean on "we've anonymised it" unless you've genuinely tested that. If someone could still be picked out by combining the data with other information, it's still personal data. When in doubt, treat it as personal data. It's the safer assumption and the cheaper one to be wrong about. --- ## **Is Your AI Provider a Data Processor?** Short answer: usually, yes. If an AI provider handles personal data on your behalf and on your instructions, it's acting as your processor. That triggers a legal requirement for a contract, set out in UK GDPR's [Article 28](https://gdpr-info.eu/art-28-gdpr/). That contract is your data processing agreement, or DPA. It's not optional, and "we accepted the standard terms" doesn't count unless those terms actually contain the Article 28 commitments. Where AI gets trickier is the fine print. Some providers use customer inputs to train or improve their own models. When they do that, they may be acting as a controller for that part of the processing, which changes the picture entirely. Free and consumer versions of tools are the usual culprits. The business or enterprise tier often comes with different terms. Before you sign anything, ask: - **Training:** will our data be used to train or improve your models, and can that be switched off? - **Retention:** how long are prompts and outputs stored, and can we delete them? - **Sub-processors:** who else touches the data, and where are they based? - **International transfers:** does data leave the UK, and what safeguards apply? - **Security:** what controls protect the data, and how are breaches reported to you? If a provider can't answer these plainly, that's an answer in itself. --- ## **Which Lawful Basis Covers Your Use of AI?** Every use of personal data needs a lawful basis. AI doesn't get a pass, and a shiny new tool doesn't create a new basis. It has to fit one of the existing six. In practice, three come up most often: - **Legitimate interests**, the most common choice for business AI use. It needs a documented three-part test: a genuine interest, a necessary way of pursuing it, and a balance against the rights of the people involved. - **Contract**, which only works when the AI processing is genuinely necessary to deliver what the person signed up for. It's narrower than people tend to assume. - **Consent**, which has to be freely given, specific and easy to withdraw. It's hard to rely on where there's a power imbalance, which is why it's rarely suitable for employee data. Two other things catch people out. First, purpose limitation. If you collected customer data to deliver a service, using it to feed an AI tool for something new needs fresh thought, not an assumption that it's fine. Second, transparency. Your privacy notice needs to say that AI is involved, what for, and what it means for the people affected. Special category data needs a lawful basis plus an additional condition. That's a much higher hurdle, and often a good reason to keep that data out of the tool altogether. [![Trust Keith Office Hours](https://resources.trustkeith.co/hs-fs/hubfs/Blog%20Banners%20(21).png?width=2048&height=400&name=Blog%20Banners%20(21).png)](https://resources.trustkeith.co/office-hours) --- ## **Automated Decision-Making and Article 22** Should a machine be allowed to decide whether someone gets a job, a loan or a place on a course? UK GDPR has a view on that. [Article 22](https://gdpr-info.eu/art-22-gdpr/) gives people the right not to be subject to a decision based solely on automated processing, including profiling, where that decision has a legal or similarly significant effect on them. "Solely" is the key word. If a human genuinely reviews and can change the outcome, Article 22 is much less likely to bite. Think about where this might apply: - A tool that automatically rejects job applications below a score. - A system that approves or declines credit, or sets prices, without anyone looking. - Software that flags employees for disciplinary action based on productivity data. Where Article 22 does apply, you can only go ahead if the decision is necessary for a contract, authorised by law, or based on explicit consent. Even then you need safeguards. People must be able to get human intervention, give their view, and challenge the decision. One trap deserves a mention. A human in the loop only counts if they're actually in the loop. If someone clicks "approve" on every AI recommendation without really weighing it up, regulators will see that as automated decision-making with a rubber stamp on top. Build in real review, and keep a record that it happened. --- ## **When an AI Tool Needs a DPIA** A data protection impact assessment is the document that shows you've thought it through before something goes live. Under [Article 35](https://gdpr-info.eu/art-35-gdpr/), you need one where processing is likely to result in a high risk to people's rights and freedoms. AI ticks the boxes more often than not. Typical triggers include: - Using new or innovative technology, which is how AI is generally treated. - Profiling or scoring individuals. - Processing special category data, or processing at large scale. - Systematically monitoring people, such as staff or website visitors. - Making decisions that could significantly affect someone. Not every AI tool needs a full DPIA. A spell-checker that never sees personal data doesn't. But a screening tool, a customer-scoring model or a meeting recorder that transcribes everything said? Probably yes. The timing matters as much as the document. A DPIA done after launch is just paperwork about a decision you've already made. Do it while there's still room to change the plan: pick a different tool, narrow the data, add a human check, or walk away. A good DPIA describes what the tool does, why you need it, what could go wrong for individuals, and what you'll do about each risk. If a serious risk remains and you can't reduce it, you'll need to consult the ICO before going ahead. [![Trust Keith Resources](https://resources.trustkeith.co/hs-fs/hubfs/Blog%20Banners%20(12).png?width=3584&height=700&name=Blog%20Banners%20(12).png)](https://www.trustkeith.co/resources) --- ## **Employee Data and AI Tools** Most conversations about AI and GDPR focus on customers. Staff are data subjects too, and they're often where the biggest gaps are. There are two sides to it. The first is what your team does with AI day to day. People paste in contracts, customer lists, support tickets and meeting notes, often using personal accounts on free tools you've never assessed. It's rarely malicious. It's just convenient. But it means personal data is leaving your business with no DPA, no assessment and no record. The second is AI used on your people. Tools that monitor productivity, screen CVs, analyse sentiment in messages or summarise performance reviews all process employee data, sometimes in intrusive ways. The imbalance of power between employer and employee makes consent a weak basis here, and transparency matters even more. The fix isn't banning everything. It's making the sensible route the easy one: - A short, plain-English AI acceptable use policy that says what's allowed, what isn't, and who to ask. - An approved list of tools that have already been through your supplier checks. - A register of AI use, so you know what's actually running in your business. - Training that uses real examples rather than a wall of legal text. If the approved option is slow or unclear, people will go around it. Make it quick and easy. --- ## **What the ICO Expects From AI Use** The Information Commissioner's Office has published detailed [guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/). It's worth a proper read, because it shows how the regulator thinks. The headline messages are consistent and, helpfully, they don't change just because the technology does. - **Accountability:** you're responsible for showing you've assessed the risks, not just for avoiding harm. - **Lawfulness, fairness and transparency:** there's a lawful basis, the outputs are fair to the people affected, and people are told what's happening. - **Data minimisation:** use the least personal data the tool needs to do the job. - **Security:** AI systems bring their own risks, so protections need to match. - **Individual rights:** people can still ask for access, correction or deletion, and that includes data inside AI systems. That last point surprises people. If someone makes a subject access request, personal data in prompts, logs and outputs may be in scope. Knowing where your AI tools store things is part of being ready to respond. This is the sort of thing Trust Keith helps customers pin down. A dedicated privacy expert works through the questions in this post with your team, and the platform keeps the evidence in one place: supplier records, DPIAs, data maps and the paper trail that shows you did your homework. --- ## **Frequently Asked Questions** ### **Does GDPR apply when we use tools like ChatGPT at work?** Yes, if personal data goes in or comes out. UK GDPR applies to the processing, whatever the technology. That covers a prompt containing a customer's name just as much as a database of thousands of records. ### **Do we need a DPIA for every AI tool?** No, but you'll need one for many of them. If a tool involves profiling, special category data, large-scale processing, systematic monitoring or decisions that significantly affect people, assume a DPIA is required. If you decide not to do one, write down why. ### **Is an AI provider a processor or a controller?** Usually a processor, because it handles data on your instructions. It may become a controller for any processing it does for its own purposes, such as training its models on your data. Read the terms carefully and get a proper DPA in place. ### **Can we use AI to make hiring or credit decisions?** You can use AI to support decisions. Making them solely by automated means is restricted under Article 22 where there's a legal or similarly significant effect. You need a permitted basis, safeguards, and a human review that's genuine rather than a formality. ### **What should an AI acceptable use policy cover?** Which tools are approved, what types of data can and can't be entered, who signs off new tools, how outputs should be checked, and where to raise a concern. Keep it short enough that people will actually read it. --- ## What should the next steps be? AI tools aren't the problem. Unexamined AI tools are. Work through the five questions before launch, write down the answers, and you'll be in a far better position than most businesses rushing to keep up. If you'd like to go deeper, these are good next reads. See how [building privacy by design into your product](https://resources.trustkeith.co/privacy-by-design-what-it-is-and-how-to-build-it-into-your-product) makes AI projects far smoother. Since every AI provider is a supplier, the guide to [managing third-party risk and DPAs](https://resources.trustkeith.co/supplier-gdpr-compliance-dpa-requirements-audit-guide) is a natural companion.  If any of this still feels uncertain, or you'd like to talk it through with someone who's handled AI reviews before, you're welcome to book some time with our team. We're happy to see how we can help. [![chat to an expert](https://resources.trustkeith.co/hs-fs/hubfs/chat%20to%20an%20expert.png?width=236&height=59&name=chat%20to%20an%20expert.png)](https://www.trustkeith.co/talk-to-us)[![Trust Keith - take data protection off your plate, for good](https://resources.trustkeith.co/hs-fs/hubfs/blog%20cta%20(5).png?width=3450&height=1150&name=blog%20cta%20(5).png)](https://www.trustkeith.co/)   ## Curious how Trust Keith can help take data compliance off your plate? [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) [![Trust Keith](https://resources.trustkeith.co/hs-fs/hubfs/raw_assets/public/Trustkeith_March2023/images/trust_keith01.png?width=268&name=trust_keith01.png "Trust Keith")](https://www.trustkeith.co/) [![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f) - Features - [Comply with data regulations](https://www.trustkeith.co/product/comply-with-regulations) - [Discover your data risks](https://www.trustkeith.co/product/discover-data-risks) - [Expert Advice](https://www.trustkeith.co/product/expert-advice) - [Govern your data protection programme](https://www.trustkeith.co/product/govern-data-protection) - [Manage breaches and incidents](https://www.trustkeith.co/product/manage-breaches-and-incidents) - [Train your staff](https://www.trustkeith.co/product/train-your-staff) - Product - [How it works](https://www.trustkeith.co/how-it-works) - [Marketplace](https://www.trustkeith.co/marketplace) - [Pricing](https://www.trustkeith.co/pricing) - [Customers](https://www.trustkeith.co/customers) - Trust Keith - [Company](https://www.trustkeith.co/company) - [Talk to us](https://www.trustkeith.co/talk-to-us) - [LinkedIn](https://www.linkedin.com/company/trustkeith/) - [Privacy policy](https://trustkeith.trustkeith.co/) © Trust Keith 2026. Trust Keith Ltd is a company registered in England and Wales number 12283797. ```json { "@context" : "https://schema.org", "@id" : "https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy#blogposting", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Trust Keith" }, "dateModified" : "2026-10-12T08:55:56+0000", "datePublished" : "2026-10-12T08:55:56+0000", "description" : "Deploying an AI tool? Here’s what UK GDPR expects first: personal data, processor terms, lawful basis, Article 22 and when you’ll need a DPIA, explained.", "headline" : "AI Tools and GDPR: What Your Business Needs to Know Before Deploying", "inLanguage" : "en-GB", "isPartOf" : { "@id" : "https://resources.trustkeith.co/#blog", "@type" : "Blog", "name" : "Trust Keith Resources Blog", "publisher" : { "@id" : "https://www.trustkeith.co/#organization" } }, "mainEntityOfPage" : { "@id" : "https://resources.trustkeith.co/ai-tools-and-gdpr-what-to-know-before-you-deploy", "@type" : "WebPage" }, "publisher" : { "@id" : "https://www.trustkeith.co/#organization", "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn.prod.website-files.com/5f462e8160aa877216f7d4b7/642bcbad7735490755580d8d_trust-keith-logo.svg" }, "name" : "Trust Keith", "url" : "https://www.trustkeith.co/" } } ```