Using AI tools with customer data: what UK small businesses should check first

Most small businesses now have someone using an AI tool. It might be a chatbot drafting replies to customer emails, a transcription service for call recordings, or an assistant summarising a supplier contract. The tools are useful, but the moment a customer's name, email address or order history goes into one, UK data protection law applies. This guide explains, in plain terms, what the Information Commissioner's Office (ICO) says about the basics, and what a small business can do this week.

Who is responsible when you use an AI tool?

The ICO explains that a controller is the organisation that decides why and how personal data is used, and that controllers hold overall responsibility for complying with the UK GDPR and must be able to show that they comply. A processor handles personal data on a controller's behalf and should act on the controller's instructions.

The ICO's own example is a gym that gives member addresses to a printing company to send event invitations. The gym is the controller and the printer is the processor. An AI tool you pay for and use on your own customer data works in much the same way: you are normally the controller, and the AI provider is a processor acting for you. The ICO also notes that if a processor starts deciding the purposes and means of the processing itself, it becomes a controller for that processing and takes on the same liability.

The practical point is simple. Buying a tool does not hand the responsibility to the vendor. You still need to be able to explain what data goes in, why, and what happens to it.

What the contract with an AI provider should cover

Article 28 of the UK GDPR sets out what must be in place when you use a processor. You should only use processors that give "sufficient guarantees" that they will apply appropriate technical and organisational measures, and the arrangement must be in a written contract, which can be electronic. Reading the legislation text, the contract must set out:

• the subject matter and duration of the processing;
• the nature and purpose of the processing;
• the type of personal data and the categories of people it relates to.

It must also require the processor to:

• process personal data only on your documented instructions;
• make sure the staff who handle the data are bound by confidentiality;
• take appropriate security measures;
• only use sub-processors with your prior written authorisation, and stay fully liable for them;
• help you respond to requests from individuals about their data;
• delete or return the data at your choice when the service ends;
• provide the information needed to show compliance and allow audits;
• tell you if it thinks one of your instructions breaks data protection law.

For most small businesses, the realistic route is not negotiating a bespoke contract. It is checking that the provider offers standard business terms or a data processing agreement that covers these points, and that you are signed up to the business plan rather than a free personal account. If a vendor cannot show you terms like these, that tells you something.

When you need a data protection impact assessment

A data protection impact assessment (DPIA) is a structured way of thinking through risk before you start. The ICO says one is required when processing is "likely to result in high risk", and it publishes a list of types of processing that always need one. The steps it sets out are:

• decide whether a DPIA is needed;
• describe the processing;
• consult individuals and others where relevant;
• assess necessity and proportionality;
• identify and assess the risks;
• identify measures to reduce those risks;
• conclude and record the outcome.

A shop using a tool to tidy up product descriptions will rarely need this. A business that plans to use AI to score job applicants, monitor staff or make decisions about customers is in a different position, and should read the ICO's DPIA guidance carefully first.

Accuracy, fairness and automated decisions

The ICO's guidance on AI and data protection has dedicated chapters on transparency, accuracy and fairness, including bias and discrimination, and on the fairness implications of Article 22, which deals with decisions made solely by automated means. In everyday terms: tell people when AI is involved in something that affects them, check what it produces before it reaches a customer, and keep a person in the loop for anything significant, such as refusing a refund, rejecting an application or setting a price for one individual.

A caveat on the guidance itself

Be aware that the ICO's main AI and data protection guidance was last updated on 15 March 2023, and the page states that it is under review and may change because of the Data (Use and Access) Act. The underlying duties, such as having a lawful reason for using data, being open with people and keeping it secure, have not gone away. But before you build a formal policy, check the ICO's pages for the latest version rather than relying on a copy someone saved last year.

Security is a team job

The National Cyber Security Centre's small business guide notes that the UK has about 5.5 million small organisations with 0 to 49 employees, that small businesses are as likely as larger ones to face online crime, and that around half suffer a cyber incident each year. It also stresses that cyber security is a responsibility for the whole team, not just one person. The same applies to AI: it only takes one member of staff pasting a customer list into a personal account to create a problem that nobody planned for.

What to do this week

• Ask, without blame. At your next team meeting, ask which AI tools people use and on which accounts. Make clear that honest answers will not get anyone in trouble.
• List what goes in. For each tool, note whether it ever receives customer names, contact details, order history, staff records or recordings.
• Check the terms. Look for a data processing agreement, what the provider does with your inputs, where data is processed, and whether a business plan changes the answers.
• Set a simple rule. For example: personal data only goes into tools the business has approved, using work accounts, never personal ones.
• Keep a human check. Anything AI drafts for a customer, or any decision that affects a person, gets reviewed by someone before it goes out.
• Write it down. A one page note of the tools, what they are used for and who approved them is enough to show you have thought about it.

The ICO also provides self-serve tools and bitesize guidance aimed at smaller organisations, which are a sensible first stop for questions specific to your business.

Where AI genuinely helps

None of this is a reason to avoid AI. Used with sensible controls, it can save real time on drafting, admin and customer queries. If you would like help choosing and setting up tools that fit how your business works, see our AI solutions page. This article is general information, not legal advice, so for anything high risk, speak to a qualified adviser.