Data Protection in the AI Era

AI changes how personal data is used

Training a model, using a chatbot or sending customer records to an AI vendor can all count as processing personal data. The same principles that apply elsewhere still apply: a clear purpose, a lawful basis such as consent where required, limited collection and appropriate security.

Questions to ask before using an AI tool

• What personal data goes in, and is it necessary?
• Does the vendor keep or reuse our data to train its models?
• Where is the data stored and who can access it?
• Can we honour access, correction and deletion requests?
• Have we updated our privacy notice to describe this use?

Practical controls

Set rules on what employees may paste into public AI tools. Run a privacy impact assessment for higher-risk use cases. Add data-use and confidentiality terms to AI vendor contracts, and keep an inventory of where AI is used in the business.

Link privacy and AI governance

Privacy reviews and AI governance reviews overlap heavily. Running them together avoids duplicate work and gives leadership one view of risk.