# UK GDPR and AI: what a small business must do in 2026

URL: https://yarigai.ai/guides/ai-gdpr-small-business
Author: Deniz Sancar, founder of Yarigai (https://denizsancar.com)
Publisher: Yarigai, a done-for-you AI agency in London, UK (https://yarigai.ai)
Published: 7 November 2026. Updated: 7 November 2026.

## Short answer
A UK small business that puts personal data through AI in 2026 must choose a lawful basis, run a data protection impact assessment (DPIA) where the ICO's high-risk tests apply, sign processor terms with the AI provider and tell people how their data is used. Since 5 February 2026, solely automated decisions with significant effects need safeguards, including human intervention, under Articles 22A to 22D. Since 19 June 2026, controllers must acknowledge complaints within 30 days.

## At a glance
| Duty | What the law or the ICO says, November 2026 |
|---|---|
| Lawful basis | Pick one of seven Article 6 bases before processing starts and record it for each purpose |
| DPIA | Required for likely high-risk processing; the ICO lists AI as innovative technology that needs one when combined with another risk factor |
| Contract with the AI provider | Article 28 terms covering documented instructions, security, sub-processors, deletion and audits |
| Automated decisions | Since 5 February 2026, significant solely automated decisions are allowed only with safeguards (Articles 22A to 22D) |
| Subject access requests | Reply within one month, extendable by up to two more months for complex or repeated requests |
| Complaints | Since 19 June 2026, make complaining easy, for example with an electronic complaint form, and acknowledge within 30 days |
| Transfers outside the UK | Adequacy regulations, the IDTA or Addendum with a transfer risk assessment, or an exception |
| Provider training defaults | OpenAI, Anthropic and Google paid APIs don't train on your data by default; Google's free tier may |

This guide summarises the law and ICO guidance as checked on 7 November 2026. It is not legal advice.

## Which lawful basis covers AI use?
Use the lawful basis that covers the task the AI does, decide it before any processing starts and record it for each purpose. The ICO's guide to lawful basis, updated on 2 April 2026, lists seven bases under Article 6 of UK GDPR. They are consent, contract, legal obligation, vital interests, public task, legitimate interests and recognised legitimate interest, which the Data (Use and Access) Act 2025 added for a set of pre-approved purposes.

The ICO says you "must determine your lawful basis before starting" and must keep a record of the basis for each purpose. It also says you should not swap bases later without good reason, and you usually can't swap away from consent.

A support agent that answers customers about their own orders processes data to deliver a contract with them. An inbox agent that sorts supplier emails would usually rely on legitimate interests, which the ICO says applies unless the person's interests override yours. Training or tuning a model on customer data is a new purpose, so it needs its own basis and its own line in the record.

## When does an AI project need a DPIA?
A DPIA is required when processing is likely to result in a high risk to people. The ICO's list says AI, as innovative technology, needs one when combined with another risk criterion. Decisions about access to a product, service, opportunity or benefit that rely to any extent on automated decision-making need one too.

Article 35(3) of UK GDPR names three cases that always need a DPIA:
- Systematic and extensive profiling with significant effects.
- Large-scale processing of special category or criminal offence data.
- Systematic monitoring of a publicly accessible area on a large scale.

The ICO adds that in most cases two of the nine screening criteria in the European guidelines, such as evaluation or scoring, indicate a DPIA. If in doubt, it recommends doing one, and if you skip it, document why the processing is unlikely to be high risk.

| AI use | How the ICO list applies |
|---|---|
| Inbox agent that drafts replies for a person to send | AI counts as innovative technology, so check for a second factor and record the screening decision |
| Website support agent answering from help articles | Same test; scale and vulnerable customers are the factors to check |
| Tool that ranks or rejects job applicants | DPIA needed, because it affects access to an opportunity and scores people |
| AI that sets credit or payment terms for customers | DPIA needed, because it decides access to a service |

## Processor terms and what AI providers do with your data
An AI provider that processes personal data for you is your processor, so UK GDPR Article 28 requires written contract terms. Check the provider's training and retention defaults before you pick a plan.

The ICO says the contract must cover:
- What is processed, why, for how long and about whom.
- Processing only on your documented instructions, with confidentiality and Article 32 security.
- No sub-processors without your prior authorisation.
- Help with rights requests, breaches and DPIAs, deletion or return of the data at the end, and audits.

Anthropic's API documentation names Anthropic as the data processor on its own API and the cloud provider as processor on Amazon Bedrock. Google processes paid Gemini API prompts under its Data Processing Addendum.

### Training and retention defaults
| Provider and tier | Trains on your data by default | Default retention | Point to check |
|---|---|---|---|
| OpenAI API | No, unless you opt in | Abuse-monitoring logs up to 30 days; Responses API state 30 days | Zero data retention needs OpenAI's prior approval |
| Anthropic API | No; retained data is never used for training without express permission | Its API docs say prompts and outputs are not retained by default, except Covered Models (Fable and Mythos), which need 30-day retention; its Privacy Center (July 2026) says API inputs and outputs are deleted within 30 days | Flagged content may be kept for up to 2 years |
| Google Gemini API, paid | No; prompts and responses aren't used to improve products | Logged for a limited period to detect abuse | Processed under Google's Data Processing Addendum |
| Google Gemini API, unpaid | Content may be used to improve products, and human reviewers may read it | Not stated | Google says not to submit personal information |

Google's terms, effective 23 March 2026, say a business may use only the paid tier when it offers an app to users in the UK, the EEA or Switzerland. For staff seats, the guide to [ChatGPT Business, Claude Team or Microsoft 365 Copilot](/guides/chatgpt-vs-claude-vs-copilot-for-business) compares the plans' data terms.

### Transfers outside the UK
Sending personal data to a separate organisation outside the UK is a restricted transfer. The ICO says every restricted transfer needs UK adequacy regulations, an appropriate safeguard such as the International Data Transfer Agreement (IDTA) or the Addendum with a transfer risk assessment, or an exception. The Act's new transfer provisions took effect on 5 February 2026.

Where the data sits matters too. OpenAI's UK data residency option stores data in the UK but doesn't process it there, while its Europe option does both in the EEA and Switzerland. Ask each provider which transfer mechanism its terms rely on.

## Automated decisions after the Data (Use and Access) Act
Since 5 February 2026, UK GDPR allows significant decisions made solely by automated means, but only with safeguards, and with tighter limits when special category data is involved. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D on that date, and the change doesn't apply to decisions taken before it.

### What counts
Article 22A defines a decision as based solely on automated processing when there is "no meaningful human involvement in the taking of the decision". A significant decision is one with a legal effect or a similarly significant effect on the person.

### What the law requires
- Article 22B bars significant automated decisions based on special category data, unless the person gave explicit consent or the decision is needed for a contract or authorised by law and meets a substantial public interest condition. It also bars them where the processing relies, even in part, on recognised legitimate interests.
- Article 22C requires safeguards. The business must give the person information about the decision and let them make representations, obtain human intervention and contest the decision.

The ICO's guidance on these rules was still marked draft on 7 November 2026. The draft says a person must review the decision before it is applied, and that ad hoc spot-checking is not enough to count as meaningful involvement.

For most small businesses the simplest route is a person who makes the decision, with the AI preparing it. A recruiter who reads the AI's summary and decides each shortlist is involved. A recruiter who signs off a batch of AI rejections without reading them probably isn't. The guide to [AI for recruitment agencies](/guides/ai-for-recruitment-agencies) covers CV screening in detail.

## Transparency, access requests and complaints
Tell people how AI uses their data, answer access requests within a month and, since 19 June 2026, run a complaints process.

### Privacy information
The ICO's right to be informed guidance says privacy information must cover your purposes, your retention periods and who the data is shared with. Give it when you collect the data, or within a reasonable period and no later than one month if the data came from another source. Name AI providers among the recipients, and explain any significant automated decision, because Article 22C requires information about it.

### Subject access requests
The ICO's guide to subject access, updated on 16 July 2026, sets these rules:
- Reply without undue delay and within one month.
- Extend by up to two more months if the request is complex or the person has sent several, and say so within the first month.
- Charge no fee in most cases.
- Run a reasonable and proportionate search.
- Pause the clock from the day you ask for clarification until the day after the reply.

Include AI chat logs, call transcripts and agent outputs that hold the person's data in the search.

### Complaints
Section 103 of the Act added section 164A to the Data Protection Act 2018, in force from 19 June 2026. Controllers must make complaints easy, for example with a form that can be completed electronically and by other means. They must acknowledge each complaint within 30 days, respond without undue delay and tell the person the outcome.

## How Yarigai handles personal data in a build
Yarigai is a done-for-you AI agency in London that builds [AI agents](/services/ai-agents), support agents that answer from a client's docs, inbox triage and document reading and filing. It builds inside the client's own accounts and tools, so the client owns the code, the data and the accounts from day one. There is nothing to sign up for, and it is not SaaS.

The client pays AI and hosting bills at cost, which means the AI provider account, its data settings and its terms sit in the client's name. A person approves anything that sends money, emails a customer or deletes data.

A project starts with a free 30-minute scope call on Google Meet. A blueprint of about a week, credited to the build, sets out a written plan, a clickable prototype, the monthly running cost and a fixed price, and the build takes 2 to 6 weeks with a weekly demo. Yarigai's guarantee reads "If the build isn't profitable for you, we won't build it."

## A UK GDPR checklist for AI in a small business
Work through these twelve points before an AI system touches personal data, and keep the answers on file.

1. List each AI use, the personal data it reads and the purpose.
2. Record the lawful basis for each purpose before processing starts.
3. Screen each use against the ICO's DPIA list, and keep the DPIA or the reason you skipped it.
4. Use a paid business tier or API, never a free or personal account, for customer or staff data.
5. Sign the provider's data processing terms and check they cover the Article 28 points.
6. Record the provider's training default and retention period for the plan you use.
7. Confirm the transfer mechanism and where the data is stored and processed.
8. Give the AI only the fields each task needs.
9. Keep a person making any decision with a legal or similarly significant effect, or put the Article 22C safeguards in place.
10. Update the privacy notice to name AI providers and explain any automated decisions.
11. Add AI logs, transcripts and outputs to the subject access search process.
12. Publish a complaints route with an electronic form and a 30-day acknowledgement.

The guide on whether [an AI agent is safe with your email, CRM and bank](/guides/is-an-ai-agent-safe) covers the security side.

## Common questions
### Do I need a DPIA to use ChatGPT or Claude at work?
Not always. The ICO requires one where processing is likely to be high risk, and it treats AI as innovative technology that needs a DPIA when combined with another risk factor, such as scoring people or large-scale processing. If staff use it to draft text with no personal data, record the screening decision instead.

### Can I put customer data into an AI tool?
Yes, if you have a lawful basis, the provider acts as your processor under written terms and the plan doesn't train on your data. OpenAI's API, Anthropic's API and Google's paid Gemini API don't train on customer data by default. Google tells users not to submit personal information to its free tier.

### Is it legal to use AI to screen CVs in the UK?
Yes, with limits. Since 5 February 2026, a rejection decided by AI with no meaningful human involvement would count as a significant automated decision and need the Article 22C safeguards, including the right to human intervention and to contest. The ICO's DPIA list means a tool that ranks or rejects applicants needs a DPIA.

### Do I have to tell customers I use AI?
You must tell people your purposes, retention periods and who receives their data, which includes AI providers. If an AI makes a significant decision about someone with no meaningful human involvement, Article 22C requires you to give them information about that decision.

### What changed in UK data protection law in 2026?
On 5 February 2026 the Data (Use and Access) Act 2025 brought in new automated decision rules, recognised legitimate interests, new subject access time limits and new transfer rules. On 19 June 2026 controllers gained a duty to handle complaints, including a 30-day acknowledgement. The ICO's automated decision guidance was still in draft on 7 November 2026.

## Sources
1. [A guide to lawful basis](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/), Information Commissioner's Office, updated 2 April 2026, checked 7 November 2026.
2. [When do we need to do a DPIA?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/), Information Commissioner's Office, checked 7 November 2026.
3. [What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), Information Commissioner's Office, checked 7 November 2026.
4. [What does the UK GDPR say about ADM?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making/what-does-the-uk-gdpr-say-about-adm/), Information Commissioner's Office, draft guidance updated 31 March 2026, checked 7 November 2026.
5. [Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/contents), legislation.gov.uk, sections 80 and 103 checked 7 November 2026.
6. [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/82/made), legislation.gov.uk, made 29 January 2026, checked 7 November 2026.
7. [A guide to subject access](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/), Information Commissioner's Office, updated 16 July 2026, checked 7 November 2026.
8. [The right to be informed](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/), Information Commissioner's Office, checked 7 November 2026.
9. [A brief guide to international transfers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/), Information Commissioner's Office, updated 15 January 2026, checked 7 November 2026.
10. [Data controls in the OpenAI platform](https://developers.openai.com/api/docs/guides/your-data), OpenAI, checked 7 November 2026.
11. [API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention), Anthropic, checked 7 November 2026.
12. [Gemini API Additional Terms of Service](https://aistudio.google.com/docs/terms), Google, effective 23 March 2026, checked 7 November 2026.
13. [How long do you store my organization's data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data), Anthropic Privacy Center, updated 1 July 2026, checked 7 November 2026.