You can use AI with customer data in the UK, but the normal data protection rules still apply, and the ICO expects you to think it through before you start. In practice, that comes down to six things: an impact assessment, a lawful reason, telling people, a contract with your AI provider, using only the data you need, and a person involved in decisions that significantly affect someone.
The rules changed recently. The Data (Use and Access) Act 2025 made automated decisions easier to use lawfully, as long as you have safeguards in place. This guide explains what that means for you.
This is practical guidance, not legal advice. It was correct at the time of writing (October 2026). The ICO is updating its guidance on automated decisions, and the final version is due in winter 2026. For anything high-stakes, check the ICO’s guidance or take legal advice.
Does data protection law apply when you use AI?
Yes, whenever the AI touches personal data: anything that identifies a person, such as names, email addresses, phone numbers, job details or messages. That includes your customers and your staff.
If the AI only works with information that isn’t about people, such as product descriptions or your price list, most of this guide doesn’t apply.
The six things the ICO expects
1. An impact assessment before you start
The ICO says that “in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA”, and that you “must carry out your DPIA before the processing of personal data begins” (ICO).
A DPIA (data protection impact assessment) is a written check of what data you’ll use, the risks, and how you’ll reduce them. For a single workflow, it can be a few pages.
2. A lawful reason for using the data
You need a lawful basis, just as you would without AI. Adding AI doesn’t create a new reason, so check that your existing one still covers the new use.
3. Telling people
Your privacy information must cover how you use personal data in AI, including “your purposes for processing their personal data”, “your retention periods for that personal data; and who you will share it with” (ICO). If an AI provider processes customer data for you, update your privacy notice to say so.
4. A contract with your AI provider
When an AI provider processes personal data on your behalf, the law requires a written contract: processing by a processor “shall be governed by a contract or other legal act… that is binding on the processor” (ICO). Before you put customer data into any AI tool, check that your plan includes data processing terms.
5. Only the data you need
Don’t paste a whole customer record when the AI only needs the question. Remove names and contact details where the task doesn’t need them. The less personal data you use, the smaller the risk and the simpler your assessment.
6. A person involved in significant decisions
If AI makes a decision about someone on its own, and that decision has a legal or similarly significant effect on them (for example, refusing a service, setting a price or turning down a job applicant), extra rules apply.
The law now calls it a decision “based solely on automated processing” when there is “no meaningful human involvement in the taking of the decision” (Data (Use and Access) Act 2025, section 80). For those decisions, you must give people information about them, let them make representations, let them get human intervention, and let them contest the decision.
What changed with the Data (Use and Access) Act?
All the Act’s data protection changes were in force by 19 June 2026 (ICO). Three matter most for a typical business:
- Automated decisions are easier, with safeguards. The Act “opens up the full range of reasons, or ‘lawful bases’, that you can rely on” for significant automated decisions, potentially including legitimate interests, as long as you “continue to apply appropriate safeguards”. This doesn’t apply to special category data, such as health information, which stays more protected.
- You need a complaints process. You must help people complain, for example with an electronic complaints form, “acknowledge complaints within 30 days” and respond “without undue delay”.
- Some website cookies no longer need consent, such as those used for statistics or to improve how your site works.
Everyday examples
| What you’re doing | Personal data? | What to do |
|---|---|---|
| Using an AI assistant to draft replies to customer emails | Yes | Use a business plan with data processing terms, paste only what’s needed, and check every reply before it goes |
| An AI chatbot on your website | Usually (names, contact details) | Update your privacy notice, make it clear it’s an automated assistant, and offer a way to reach a person |
| AI ranking leads for your sales team | Yes | A DPIA, plus a person makes the final call on who gets contacted |
| AI deciding who gets a quote, a service or a job interview, with no person involved | Yes, and it’s likely a significant decision | A DPIA plus the automated-decision safeguards: information, representations, human intervention and the right to contest |
| AI summarising your price list or product specs | No | Data protection rules don’t apply to the content, though check the tool’s terms anyway |
A checklist before you switch it on
- I know what personal data the AI will touch, and where it goes
- I’ve done a DPIA, or decided in writing why one isn’t needed
- My lawful basis covers this use
- My privacy notice mentions it, including any AI provider we share data with
- I have data processing terms with the AI provider
- The AI only gets the data it needs
- A person checks anything that significantly affects someone
- People can complain easily, and we reply within 30 days
Next steps
Every AI Opportunity Audit includes a data protection check: what personal data each opportunity would use, where it would go, and the safeguards it needs. If your team already uses AI tools, AI training includes a one-page AI use policy covering what must never go into them.