GDPR Doesn’t Pause for AI
GDPR doesn't pause for AI. You're still the data processor, even when AI is doing the processing. That's the legal reality.
·4 min read
Here is a sentence you will not find in most AI vendor brochures.
You’re still the data controller, even when the AI is doing the processing.
GDPR does not pause for AI. That’s the legal reality you need to sit with before signing any AI contract. The demos are impressive, but the liability is entirely yours.
The ICO is explicit that using AI to process personal data does not transfer the legal responsibility away from the controller, and ICAEW’s guidance makes it equally clear that accountants are considered data controllers for the personal data they hold on clients (in almost all cases).
What You’re Actually Authorising When You Sign Up for AI
When you connect a client dataset to an AI tool, you’re appointing a data processor. Under Article 28 of UK GDPR, you’re required to appoint only processors that provide sufficient guarantees around their technical and organisational security measures.
The question isn’t whether the AI product looks secure, it’s what happens to your client data under the bonnet, once you’ve granted it access.
The answer is often an uncomfortable one. Many AI products are built on top of frontier models, like GPT-4, Claude, and Gemini, via API integrations. When client data passes through those integrations, it enters a sub-processor chain that may include data centres outside of the UK and EU, and third-party systems that your vendor has never explicitly disclosed to you. You may not know they exist, but Article 28 requires that you do.
As Bright’s Chief Product and Technology Officer, Ben Bishop, puts it:
“Data residency is not a technical detail. It is a professional responsibility. When we designed Bright’s AI architecture, the first question we answered was where does client data go, and who can touch it. The answer has to be nobody outside Bright’s controlled environment, and it has to be contractually guaranteed, not just asserted in a FAQ.”
The Training Data Problem
Is your client data being used to train the model?
Some AI vendors include model improvement provisions in their terms of service that allow them to use user data to refine their underlying models. For tools processing client financial data, NI numbers, payroll records, and personal tax information, this is a serious compliance problem.
If a vendor can’t provide a written, contractually committed zero-training exclusion, then that conversation should end. A privacy policy is not a data processing agreement.
The Geography Question
Where is the data stored, physically, and under whose jurisdiction?
Post-Brexit, UK GDPR and EU GDPR diverge in certain respects, but both maintain restrictions on international data transfers. If your AI vendor is routing client data through servers in the United States (and a significant number of cloud AI products do) you need to know on what legal basis that transfer is being made, and whether the guarantees in place are adequate.
What a Proper Data Protection Conversation Looks Like
Before any AI tool processes client data, you should have written answers to four specific questions:
Where is client data stored geographically, and which sub-processors have access to it? The answer needs to name jurisdictions and sub-processors, not just claim enterprise-grade standards.
Is client data used to train the underlying model at any point? If the vendor cannot give you a written zero-training exclusion, the answer is unknown.
What is the vendor’s Article 28 data processing agreement, and does it cover all sub-processors in the chain? A one-page DPA that doesn’t name sub-processors or doesn’t include a zero-training commitment does not meet the standard.
What happens to client data if you terminate the contract? Retention, deletion timelines, and the right to erasure all need to be addressed specifically for AI-processed data.
The Audit Trail Obligation
GDPR is not only about how data is stored. It’s also about accountability. In an AI context, that means every AI action involving personal data needs a complete, replayable audit trail. It should include which model processed it, what the input was, what the output was, and when it happened.
“The AI handled that” is not a professional defence under UK GDPR.
What the Right Architecture Looks Like
A walled garden with dedicated infrastructure, UK or EU sub-processors only, full observability, contractually committed zero-training exclusion, and a complete, auditable log of every AI action.
That is the standard the profession should be demanding from every AI vendor.
The firms that ask these questions before signing won’t just be GDPR compliant, they’ll be the ones that don’t spend 2027 explaining to the ICO why client data ended up somewhere it was never supposed to go.
Check out our guide for more information on this, Six Questions Every Accountant Should Ask Before Buying AI. Download it here.
This content may have been developed with the assistance of AI tools. Content is reviewed by a member of the Bright team before publication. Guidance on legislation can be obtained from your industry body.
Talk to our team
See how Bright can help your practice.
