Using AI with client and staff data: the data protection basics
AI tools are only as safe as the data you put into them. What UK GDPR asks of a small business using AI, and five checks before anyone pastes in a spreadsheet.
If you use an AI tool to work on information about customers, employees or anyone else, the usual data protection rules apply. You need a lawful reason to use the data, you should use no more than you need, and you must keep it secure. The tool’s provider is usually your processor, and you need a contract that says how it will handle the data.
Five checks before you start
- The toolIs it a business version that does not use your data for training, with a data processing agreement?
- The dataCould you do the task with anonymised or less data?
- The peopleWould they expect their data to be used this way? Have you told them in your privacy notice?
- The riskFor high-risk uses, or special category data such as health, have you done an impact assessment?
- The outputWho checks the result before it is relied on or sent to anyone?
Rules worth writing down
- No personal data in free consumer AI tools.
- No client documents uploaded without the client’s agreement where confidentiality applies.
- Decisions that significantly affect people are not made by AI alone.
- Staff know who to ask before they try a new tool.
The Information Commissioner’s Office publishes guidance on AI and data protection, and it is the place to start for anything beyond the basics.
Sources
- Information Commissioner’s Office, Guidance on AI and data protection
This insight is general information, not advice for your circumstances. Talk to us before acting on it.