In short
If an AI tool processes information about identifiable people, such as customers, callers or staff, that processing must meet UK data protection law like any other. The questions are the familiar ones: why you are using the data, whether you have a lawful basis, how long you keep it, who else processes it and how people can exercise their rights. This page is general guidance, not legal advice.
The rules that apply
| UK GDPR | The core principles: lawful, fair and transparent processing, purpose limitation, data minimisation, accuracy, storage limits and security. |
|---|---|
| Data Protection Act 2018 | Sits alongside UK GDPR and sets out UK-specific provisions and exemptions. |
| Data (Use and Access) Act 2025 | Amends both, including the rules on automated decision-making. Its provisions come into force in stages, so check the current position. |
| ICO guidance | The ICO publishes guidance on AI and data protection and on explaining decisions made with AI. |
Practical steps before you switch an AI tool on
Identify the personal data involved and your lawful basis for using it. Update your privacy notice so people know AI is used and for what. For processing likely to result in a high risk to people, UK GDPR requires a data protection impact assessment (DPIA), and the ICO considers many uses of innovative technology such as AI to fall in that category.
Check the supplier. You need a written contract covering their role as a processor, where data is stored, whether it is used to train their models, and how it is deleted. International transfers out of the UK need a valid transfer mechanism.
Automated decisions about people
Decisions made solely by automated means that have a legal or similarly significant effect on someone, such as refusing credit or rejecting a job application, have long carried extra protections. The Data (Use and Access) Act 2025 reformed these rules: it widens when such decisions are allowed but requires safeguards, including telling people about the decision, letting them make representations, and offering human intervention and a way to contest it. Stricter limits remain where special category data, such as health information, is involved.
The safest design for most small businesses is to keep a person meaningfully involved in any decision that significantly affects someone, and to take advice if you plan to automate one.
Call recording and voice agents
A phone agent that records or transcribes calls is processing personal data. Tell callers at the start of the call, keep recordings and transcripts only as long as you need them, and restrict who can access them. Payment card details should not be captured in recordings or transcripts.
When this matters
Relevant to any AI use involving customer, caller or staff information. New Era AI builds UK GDPR considerations into its audits and builds, but your organisation remains the controller and should take legal advice for its specific circumstances.
Questions
Do we need a DPIA to use AI?
If the processing is likely to result in a high risk to people, yes. The ICO lists innovative technology, including AI, as a factor that often makes a DPIA necessary. A short DPIA is good practice even when it is borderline.
Can staff paste customer details into a public AI chatbot?
Not without checking the tool’s terms, your lawful basis and your contract with the provider. Many incidents come from staff using free consumer tools with customer data. A clear policy and an approved tool prevent most of them.
Is this legal advice?
No. It is a general overview. For your specific situation, speak to a qualified data protection adviser or solicitor, and check the ICO’s current guidance.