GDPR and UK data residency for AI — a checklist that fits on one page

The UK GDPR is functionally equivalent to EU GDPR for most small business purposes, with one important distinction: UK businesses processing personal data through AI tools need to understand where that data is going and what the supplier does with it.

Here is the checklist we run through before any agent goes near client data.

The ten checks

1. Where is the data processed? If you are using a US AI API, data is leaving the UK. Most major US providers have Standard Contractual Clauses in place — check they are current.
2. Is the supplier using your data to train their models? Some do by default. Check the Data Processing Agreement and opt out if the option exists.
3. Do you have a signed DPA with every AI supplier that touches personal data? If not, you are not compliant regardless of their privacy policy.
4. What is the data retention period? API inputs are often retained for 30 days by default. Check whether that is appropriate for the data type you are sending.
5. Are you sending the minimum necessary data? If the AI only needs a name and an enquiry type, do not send the full customer record.
6. Is there a human in the loop for decisions that affect people? Automated decisions with legal or significant effects require human review under UK GDPR Article 22.
7. Do your privacy notices mention AI processing? If you are using AI to process customer data, your privacy notice needs to say so.
8. Can you fulfil a Subject Access Request across your AI tools? If a customer asks what data you hold on them, can you account for what was sent to your AI supplier?
9. Do you have a process for data breaches at the AI supplier level? If they are breached, you need to know quickly.
10. Has your Data Protection Officer or legal team reviewed this? This checklist is a starting point, not legal advice. Get a qualified review for anything high-risk.

If you are building AI tools that handle UK customer data and want a second opinion on your setup, get in touch.