Most AI use in a business touches personal data somewhere: an email thread full of names, a CV to sum up, a meeting with clients recorded and written up. Data protection law did not change because AI arrived. Whatever the tool, it asks the same questions it always has, and several of them are harder to answer for an AI tool than for anything else your people use.
None of this is legal advice. Your data protection lead or your advisers decide the position. Before personal data goes into a tool, these are the checks we would want answered in writing, and they apply in broadly the same shape under UK and EU law and under the growing number of US state privacy laws.
Eight checks before personal data goes in
- 1 Are you allowed to use it this way?
- 2 Does the tool need the personal data at all?
- 3 Is the vendor working under a contract with you?
- 4 Where does the data go?
- 5 Will it be used for training, and how long is it kept?
- 6 Do you need a data protection impact assessment?
- 7 Is the tool making or shaping decisions about people?
- 8 Can you still meet people's rights?
1. Are you allowed to use it this way?
Personal data is collected for a purpose, and using it in an AI tool has to fit that purpose and a lawful basis. If a client's contact details are held to deliver a service, they can reasonably be used to draft a reply to that client.
The same details pasted into a tool to build a marketing list are a different use. Your privacy notice also has to describe how you use the data, so check that it covers AI tools in general terms.
2. Does the tool need the personal data at all?
Often it does not. A contract can be condensed with the names removed, and a complaint can be drafted from a description rather than the customer's record.
3. Is the vendor working under a contract with you?
On a business plan, the vendor usually acts on your instructions under a data processing agreement you can read and sign. On a personal plan, the terms are between the vendor and the individual who signed up, and your business has no agreement at all. That is the single biggest data protection difference between the two families of plan.
4. Where does the data go?
Most AI vendors process data in the United States, at least in part, so personal data from the UK or EU is being transferred. Vendors usually rely on standard contract clauses together with the EU-US Data Privacy Framework or the UK's extension to it.
The framework is in force, and an appeal against it was pending at the EU Court of Justice in October 2026, so check what each vendor relies on and whether it offers storage in a region you choose.
5. Will it be used for training, and how long is it kept?
Check the terms for the tier you are on, because business tiers generally exclude your content from training by default and personal tiers generally do not. Retention periods differ between them too. Once you have the answer, record it next to each tool on your register of approved tools.
6. Do you need a data protection impact assessment?
Where processing is likely to be high risk, an impact assessment is required, and the UK regulator has long said that most uses of AI to process personal data will need one. Large volumes, sensitive data, monitoring people and new technology each make one more likely to be needed. The assessment is also the document a client, an auditor or the regulator will ask for.
7. Is the tool making or shaping decisions about people?
Screening CVs, scoring applications or ranking performance are decisions about people, and data protection law treats them with particular care. In the UK, the rules on decisions made solely by automated means were replaced from 5 February 2026 by a more permissive regime. It still requires safeguards: telling the person, letting them make representations and giving them a human who can look at the decision again.
EU law remains stricter. Either way, a person with the authority to change the outcome has to review it, and the review should be written down. AI in hiring applies this to the most common case.
8. Can you still meet people's rights?
If someone asks for a copy of their data, or for it to be deleted, you need to be able to find what went into AI tools about them. On a company account with a register, that is a search. Across a dozen personal accounts nobody administers, it cannot be done, which turns an ordinary request into a difficult one.
Sensitive data needs a higher bar
Health information, ethnicity, religion, sexual orientation, trade union membership, biometric data and criminal records carry stricter conditions everywhere.
Your own people's data
When AI is used on your own people, it raises the same questions with less visibility, because the people affected are rarely the ones choosing the tool. Drafting a performance review, writing up a grievance, transcribing a team meeting or reviewing how people spend their time all involve personal data about colleagues. They belong in the policy explicitly, and some will need an impact assessment of their own.
What goes into the policy
Three lines cover most of it. The data list in your AI policy should say what may happen to personal data and to sensitive data, rather than leaving them inside "confidential information". The review rule should name decisions about people as work a person always checks. So that nobody has to judge it fresh each time, the policy should also list what triggers an impact assessment.
Where this fits
The register, the policy and the move to company accounts come out of Govern, and they are what make checks 3, 5 and 8 answerable. If personal data has already gone somewhere it should not have, what to do when client data is pasted into ChatGPT sets out the first hours. We build the controls and the records, while the legal position stays with your data protection lead and your advisers.