Is your client data safe with AI? A plain-English guide to UK GDPR

If you handle client information, you need to know where it goes when AI is involved. This is a plain-English overview of the questions we work through with every client. It is general information, not legal advice.

Know what data the automation touches

Before building anything, we list the information each automation needs to see: names, email addresses, invoice amounts, documents. If a step doesn't need personal data, we design it so it doesn't see any. Using less data is the simplest protection there is.

A written agreement

We sign a data processing agreement with every client, setting out what we do with your data, how we protect it and what happens at the end of the work. It is designed around UK GDPR, which sets the rules for handling personal data in the UK.

Choose tools carefully

Not all AI tools treat data the same way. We prefer business versions of tools that offer clear data terms, and where a tool lets us switch off the use of your data to train its models, we switch it off.

Access you approve, and can withdraw

Automations connect to your systems with the access you approve, no more. You can see what is connected and remove access at any time. A named person on your side can pause any automation.

People approve what reaches clients

Anything that goes to a client is checked by a person first. That protects quality, and it also means a human has looked at what is being shared before it leaves your business.

Questions to ask any provider

Where is our data processed? Is it used to train models? Who can access it? What happens to it when we stop working together? Will you sign a data processing agreement? Any provider should be able to answer these clearly.

Good automation and good data protection go together. Ask the questions early and write the answers down.