Plain-English guide

Is it safe to use AI with customer data? A plain UK guide.

It can be, if you are careful about which tool you use and what you put into it. Here is what to think about first.

By Henry Bampfylde · 1 October 2026

This is general information for small businesses, not legal advice. For anything specific, check the official guidance or ask a qualified adviser.

Why it matters

Customer names, emails, phone numbers and notes about them are personal data. In the UK, UK GDPR applies when you handle them, and that includes typing them into an AI tool. The rules aren't special to AI, but AI makes it very easy to paste in more than you should.

Questions to ask before you use a tool with customer information

• Is this a business account, or a free personal one? Business plans usually come with clearer terms about how your data is handled than free personal accounts do.
• Is my data used to train the tool? Check the settings and the terms. Many business plans turn this off by default, but check rather than assume.
• Where is the data stored and who can see it? The provider's data and privacy pages should say.
• Is there a data processing agreement? If a provider handles personal data for you, UK GDPR expects a written contract covering it. Reputable providers have one available.

Simple habits that reduce the risk

• Leave out what the job doesn't need. If you're drafting a reply, you often don't need the customer's full details in the prompt.
• Be especially careful with sensitive information such as health details. Don't paste it into a tool casually.
• Keep a person checking anything that goes to a customer.
• Say in your privacy notice that you use tools like this, if you do.
• Give staff a short, written rule about what can and can't go into AI tools.

Registering with the ICO

Many organisations that handle personal data need to pay a data protection fee to the Information Commissioner's Office (ICO). Some are exempt. The ICO has a short self-assessment on its website, and it also publishes guidance on AI and data protection at ico.org.uk.

How I approach it

Nothing of yours is touched during my audit. It's a conversation, not access to your systems. If we go further, anything I set up uses the minimum access it needs, agreed in writing first. Security comes first, and I'd rather tell you "not yet" than set something up that isn't safe.