Can an AI worker handle client data under UK GDPR?

Yes. UK GDPR does not stop a business giving client data to an AI worker. It treats it like any work done with personal data on your behalf: your business stays the controller and answers for the data, whoever runs the AI worker for you, acting only on your instructions, is your processor, and the law requires a written contract between you with terms it lists. What the law treats differently is a significant decision about a person taken with no meaningful human involvement, and a well-specified role leaves those decisions with a named person.

Who is responsible for the data?

UK GDPR applies across the United Kingdom. It defines a controller as the body that decides the purposes and means of processing personal data, and a processor as a body that processes it on the controller's behalf. The Information Commission's Office (ICO) is plain about the consequence: the controller is responsible for complying and must be able to show that it does, while a processor has more limited responsibilities.

A letting agency or clinic that gives admin to an outside provider's AI worker keeps those duties. Article 28 adds one: to use only a processor that gives sufficient guarantees of meeting the law's requirements.

What must the contract say?

Article 28 requires a written contract between controller and processor. It must set out what the processing is about, how long it lasts, its nature and purpose, the type of personal data and the categories of people it concerns. It must bind the processor:

• to process the data only on your documented instructions, including on any transfer of it outside the UK;

• to hold everyone who handles it to a duty of confidence;

• to keep it secure;

• to bring in another processor only with your written authorisation;

• to help you answer people who exercise their rights;

• to help you with security, breaches and impact assessments;

• to delete or return the data when the contract ends;

• to give you what you need to check all of this, including audits.

What your instructions are, which other processors you have authorised and where each handles the data is not in the law. It is in your contract with the provider. The last matters because UK GDPR restricts transfers of personal data outside the UK: unless an exception applies, one needs UK adequacy regulations or appropriate safeguards behind it. So it is a question to ask any supplier.

Where is the data held, and is it used to train AI?

Both are questions to put to any provider. Ours is one sentence: Your data is stored in the UK, and is never used to train AI models.

Do you need a data protection impact assessment?

A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to people. The ICO's list of processing that needs one includes innovative technology, and it names AI, where that is combined with any of the criteria in the European guidelines the ICO refers to, such as sensitive data or processing on a large scale. Whether a role crosses that line depends on the data it touches, so the judgement is yours as controller, with your processor obliged to help. The ICO's guidance on contracts and on impact assessments is under review following the Data (Use and Access) Act 2025 and may change.

Which decisions must stay with a person?

Since 5 February 2026 UK GDPR has dealt with automated decisions in Articles 22A to 22C. A decision is "based solely on automated processing" if there is no meaningful human involvement in taking it, and it is "significant" if it has a legal effect on a person or one that is similarly significant. Where a significant decision is taken that way, the controller must have safeguards: the person is told about the decision, can make representations, can obtain human intervention and can contest it. Where the decision is based wholly or partly on special category data, such as health data, it may not be taken solely by automated processing unless one of the conditions in Article 22B is met.

An AI worker's role specification says where it stops. The worker gathers, checks, drafts and chases. Accepting or refusing a client, a tenant or a job applicant, setting a risk rating, and anything else that changes what happens to a person is taken by a named person at your business, who sees the worker's reasoning and is free to disagree with it. Our article on AI and AML checks draws the same line.

What happens if there is a breach?

A processor that becomes aware of a personal data breach must tell the controller without undue delay. The controller must report a notifiable breach to the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Whether a breach is notifiable, and the report itself, are the controller's. The contract says how you will be told.

What to settle before an AI worker starts

1. The data the role needs. The role specification lists the records the worker reads and writes, and is agreed with you before it starts. A worker on enquiry and inbox triage needs different access from one doing client onboarding.

2. The named people. Who checks the worker's work, who takes each decision it prepares, and who decides whether a breach is reported.

3. Your own paperwork. Whether a DPIA is needed and what your privacy information tells clients are judgements under your own policies. This article states the duties and is not advice on meeting them.

For your business, the worker would gather, check, draft and chase inside a role agreed in writing, and a named person of yours would take every decision about a person, whether a client, a tenant or a job applicant. Your data protection lead will want the role and the contract on paper before the worker starts. Talk to our agent.