AI, GDPR and the Data (Use and Access) Act: what UK businesses need to know

Every time an AI tool reads an email from a customer, an expense receipt from an employee or a supplier contact record, it's processing personal data. UK GDPR applies, as it always has. The Data (Use and Access) Act 2025 changed some of the rules, particularly around automated decision-making. Here's what that means in practice. This isn't legal advice, and the ICO's guidance is still developing, so take proper advice for anything high-risk.

The basics still apply

• Lawful basis. You need one for the processing. For processing invoices and orders it's usually contract or legitimate interests, the same as before AI arrived.
• Transparency. Your privacy notice should say, in plain terms, that you use AI tools in processing and what for.
• Data minimisation. Only give the AI what it needs. An invoice agent doesn't need your employees' HR records.
• Processors. The AI provider is a processor (or more). You need terms with them. Microsoft's Business Central and Copilot features are covered by Microsoft's data protection terms; a free chatbot an employee signed up to is not.
• Security. Access controls, logging, and keeping data in the right places.
• Retention. If an agent stores memory or logs containing personal data, they need a retention period like anything else (see retention policies).
• Rights. Subject access requests cover data an AI holds or produced about a person.

What changed: automated decision-making

The old UK GDPR Article 22 largely restricted decisions based solely on automated processing that had legal or similarly significant effects on a person. The Data (Use and Access) Act 2025 replaced it with a more permissive framework: solely automated decisions are generally allowed, provided safeguards are in place, such as telling people about the decision, letting them make representations, obtain human intervention and contest it. Stricter rules remain where special category data (such as health) is involved.

For most Business Central uses this matters less than it sounds, because the agents prepare work for a person to approve; they don't make significant decisions about individuals on their own. Where it does matter: automated credit decisions on sole traders, automated expense rejections for employees, or anything that could affect a person's pay, credit or employment. Keep a human in those decisions and you stay on safe ground.

Practical steps for Business Central users

1. List where AI touches personal data: mailboxes agents read, expense receipts, contact records, MCP access.
2. Do a DPIA (data protection impact assessment) for anything new and significant, particularly the Expense Agent and any custom agent with broad access.
3. Update your privacy notice to mention AI-assisted processing.
4. Use approved tools only (see a one-page AI policy).
5. Limit agent permissions to the data the job needs.
6. Keep a human in decisions about people.
7. Classify your data properly in extensions, so the tooling knows what's personal (see data classification).

The ICO publishes guidance on AI and data protection and updates it as the law changes; check it before relying on anything here.

Related posts