UK GDPR and AI: A Practical Checklist for Small Businesses in 2026

Adopting AI does not require a law degree, but it does require a few clear habits. The Information Commissioner has been steady on the point: UK GDPR applies just as much to clever new tools as it does to old fashioned databases. Use this checklist before you sign a contract with any AI vendor.

1. Identify your lawful basis up front

For most B2B work, legitimate interest is appropriate and you must document a balancing test. For consumer data, you usually need consent and it must be freely given, specific and revocable.

2. Know where the data lives

Ask every supplier for a data flow diagram. If model training happens outside the UK or EU, check that an International Data Transfer Agreement or the UK Addendum to the EU SCCs is in place.

3. Set a retention period and stick to it

Most AI tools default to keeping conversations forever. That is rarely what you want. 30 to 90 days is sensible for support chats. Document it in your privacy notice.

4. Get cookie consent right

Under PECR, analytics and marketing cookies need consent before they fire. Accept and Reject buttons must be equally easy to click. No pre ticked boxes, no dark patterns.

5. Do a quick DPIA for higher risk uses

If AI is making decisions about people, doing large scale monitoring or processing special category data, a Data Protection Impact Assessment is required. Keep it proportionate, but write it down.

6. Train the humans

The single biggest data risk in any AI project is staff pasting sensitive data into a public chatbot. A 30 minute lunch and learn solves 80 percent of it.

If you want a friendly second pair of eyes on a project, drop us a line. Compliance is part of every Limelai build and it does not cost extra.