GDPR and AI: using LLMs safely with UK customer data
You can use AI on customer data lawfully and safely; plenty of UK businesses do. The rules are mostly the ones you already know, applied carefully to some new plumbing.
The practical view from people who build these systems, not legal advice; for edge cases, talk to a data-protection professional.
Does UK GDPR have special rules for AI?
UK GDPR doesn't have a special AI chapter. The same principles apply: lawful basis, minimisation, security, retention, transparency. If your CRM use is compliant, the framework for AI use is familiar; what changes is where data flows and who processes it.
What actually matters for GDPR when a business uses AI?
1. Know whether your data trains someone's model. The major API providers (OpenAI, Anthropic, Google) do not train on business API data by default under their commercial terms. But consumer tools have different terms, and this is the classic trap: staff pasting customer records into a free chatbot account. Fix it with a paid workspace, clear policy, and systems that make the safe path the easy path.
2. Data processing agreements. An AI provider handling your customer data is a processor. You need a DPA with them, same as with your email host. The major providers all offer them; a supplier who can't is a red flag.
3. Minimisation is a design decision. An automation that drafts replies doesn't need the customer's full record; it needs the thread and relevant facts. Well-built systems send the minimum useful context per task. This is cheaper as well as safer: smaller context, smaller bills.
4. Retention and deletion flow through. If a customer's data must go, it must go from the AI layer too, including any indexes or embeddings built from it. Ask any supplier: "when I delete a record, what happens in your system?" A good answer is specific.
5. Automated decisions need a human. Since 5 February 2026, when the Data (Use and Access) Act 2025 replaced Article 22, UK GDPR allows more significant decisions to be made solely by machine, but only with safeguards: you must tell people, let them make representations, give them a way to get a human to step in, and let them contest the decision. Decisions based on special category data, such as health information, remain tightly restricted. The design answer is still the human approval step, which you should want anyway (here's why). AI drafts, flags and sorts; people decide.
What should you ask an AI supplier about GDPR?
- Where is the data processed and stored, and under which terms?
- Is any of it used for model training? Show me where the contract says no.
- What's logged, for how long, and who can see it?
- How does deletion propagate?
- Which decisions can the system take without a person?
A supplier who answers crisply has thought about it. One who says "don't worry, it's encrypted" hasn't understood the question.
How does M22 help with this?
Everything M22 Consultancy builds is UK GDPR-native by design, with a human approving any decision that matters, in line with the safeguards this article sets out. The AI Audit maps where customer data actually flows through your business before M22 recommends anything, and any build M22 delivers comes with documentation the client owns, so your compliance position does not depend on M22 staying involved. The AI Audit starts at £1,500, a fixed fee agreed before day one. Book a thirty-minute call to talk through your data flows.