Data protection in AI projects: a GDPR and UK GDPR checklist for businesses

AI assistants and automation systems often work with personal data: customer names, email addresses, order details and support conversations. When that data is sent to a language model or a cloud automation service, data protection obligations under the GDPR (and the UK GDPR for UK data subjects) apply. This article collects the questions to ask and the safeguards to put in place before a project starts.

This article is for general information only and is not legal advice. For a specific project, consult a data protection specialist.

1. What data goes where?

Start with a data flow map:

• Which personal data does the assistant or automation process? (names, phone numbers, emails, orders; any special category data such as health information?)
• Which services receive this data? (model provider, vector database, automation platform, email service)
• In which countries are those services' servers located?
• Where, and for how long, is the data stored?

Without this map, neither an accurate privacy notice nor a proper transfer assessment is possible.

2. Do you really need personal data?

The most effective safeguard is not sending unnecessary data at all (data minimisation). Many AI tasks do not need a person's name or phone number:

• Classifying support requests only needs the message content; names and contact details can be masked before being sent to the model.
• Knowledge-base assistants should not include documents containing personal data.
• Reporting automations can often work with aggregated rather than individual data.

3. Lawful basis and international transfers

Every processing activity needs a lawful basis (for example, performance of a contract or legitimate interests, supported by a balancing test). Many model providers and cloud services process data outside the UK and the EU. Transfers must rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified US providers, and the UK Extension for UK data) or on appropriate safeguards such as Standard Contractual Clauses, with the UK International Data Transfer Addendum where relevant. Identify the transfer mechanism for each service before the project starts.

4. The model provider's data policy

For business API offerings, the major model providers state that submitted data is not used for model training by default. Data may, however, be retained for a limited period for purposes such as abuse monitoring, and some providers offer zero data retention options for eligible customers. Read the provider's current data processing agreement (DPA) and retention policy at the start, and use business APIs rather than free consumer apps.

5. Transparency

• Update your privacy notice to cover the services used by the AI assistant and automations.
• Make it clear to users that they are talking to an AI assistant.
• State that answers are informational and that critical matters are passed to a person.
• Where decisions with legal or similarly significant effects are automated, check the specific rules on automated decision-making and make sure a human review is available.

6. Retention and erasure

Define retention periods for chat logs, automation logs and vector database content, and enforce them with automatic deletion jobs. When someone asks for their data to be erased, you need to know which systems hold it and be able to delete it from all of them.

7. Technical safeguards

• Access control: The assistant must not answer from documents the user is not authorised to see. Apply permissions at document level.
• Credentials: Keep API keys out of code and workflows; store them in a secrets manager.
• Encryption: Encrypt data in transit (HTTPS) and at rest.
• Logging: Record who accessed which data and which automation processed which record.
• Prompt injection: Text from users or documents can act like instructions to the model. Limit what the assistant is allowed to do, and never let it make payments, delete data or export data without human approval.
• DPIA: For large-scale or high-risk processing, carry out a data protection impact assessment before launch.

8. The EU AI Act

The EU AI Act is being phased in. Businesses serving the EU market should identify the risk category of the AI systems they use and follow the transparency obligations that apply, such as disclosing that users are interacting with an AI system.

Quick checklist

• Data flow map completed
• Unnecessary personal data masked or not sent at all
• Lawful basis and transfer mechanism identified for each service
• Model provider's DPA and retention policy reviewed
• Privacy notice updated and AI use disclosed
• Retention periods defined and automatic deletion in place
• Access control, encryption and logging active
• Critical actions require human approval
• DPIA carried out where required

Conclusion

Data protection is not a layer to add later in AI projects; it is one of the first architectural decisions. A well-designed assistant or automation meets GDPR obligations and saves time without costing customer trust.

uurstudios designs AI applications and automation systems with data mapping, masking, access control and retention policies built in. See the services overview or get in touch.