GDPR, client data, and AI: what you need to get right
How to stay inside your contracts while still using the tools.
Most small businesses are operating on assumptions. Nobody's quite sure what's legally and ethically allowed with internal and client information. Nobody has asked, either, and the work needs to go out by Friday.
Here is what GDPR actually requires of you in that scenario. Your client contracts probably already say something too. Read both, and you can keep using AI on client work without storing up problems.
You're a processor, and that carries obligations
The assumption most small businesses run on is that GDPR is about personal data and they don't really handle any. GDPR applies whenever you process information relating to an identifiable person, and that covers more than names and email addresses. Customer lists. Research with identifying detail. Internal documents naming individuals at the client company. Photographs of real customers or employees. If a client has ever sent you any of that, you are processing personal data.
Your client is the data controller: they decide why the data is used. You are the processor, handling it on their behalf. That carries real obligations. Process it only for the agreed purposes, keep it secure, don't share it with third parties without permission. Pasting it into a general AI tool is sharing it with a third party, whether or not the AI company ever misuses it.
Anonymise and you're clear
Names replaced with "Client A", "Stakeholder 1"
Emails, phone numbers and addresses stripped
Logos, headers, footers and file metadata removed
Figures rounded where the exact number isn't needed
The tells checked: file paths, screenshots, footers
You need a DPA
Faces and identifiable images of people
Voice recordings
Anything where the identifying element is the asset itself
Real client information that has to stay intact
Regular ongoing client work, not a one-off
You're responsible for where your clients' data ends up. Not the AI company.
Your contract probably already covers this
Most service contracts include a data processing clause, whether or not anyone read it closely at signing. It usually commits you to process data only on documented instructions, keep it secure, notify the client of a breach and, the one that matters here, not to engage sub-processors without written authorisation.
An AI tool processing client data is a sub-processor. Using one on their data without telling them is a contractual breach, separate from any GDPR question. Most clients haven't asked yet. That isn't the same as the breach not happening.
The instrument that fixes it is a Data Processing Agreement. The picture across the major tools is uniform: consumer and individual tiers don't offer one, business tiers do. Which leaves exactly two compliant routes, anonymise the data or move to a business tier. There isn't a third.
The answer worth having ready
More clients are asking, and the businesses that answer well are the ones that did the work first. The answer is short. "Yes, we use AI on parts of our work. We're on the business tier of [tool], so our data, including any of yours we process, isn't used to train models. It's covered by a Data Processing Agreement, and we've documented what we use AI for and how."
The businesses that lose work on this question are the ones answering it for the first time when it's asked. If you want it to be true when you say it, start by auditing what your team actually pastes into these tools in a normal week, rather than what the policy says they do.
Three things to do this week
01
Work out what actually counts as client data
Names tied to anything else, contact details, health or financial information. If it identifies a person, it counts.
02
Anonymise before you paste, not after
Done properly it stops being personal data, which takes the whole question off the table.
03
Get a Data Processing Agreement for anything real
If actual client information has to go in, the tool needs a DPA. That's the paperwork that makes it defensible.
What to say when a client asks
Yes, we use AI on parts of our work. We're on the business tier of [tool]. That means our data, including any of yours we process, isn't used to train models. It's also covered by a Data Processing Agreement. We've documented what we use AI for and how. Happy to further explain.
Conclusion
01
If you handle client data you're a data processor under GDPR, and that carries specific obligations.
02
Pasting client data into a general AI tool is the most common way small teams breach them.
03
The fix has four parts: know what counts, anonymise where you can, get a DPA, and write it down.
Go to next