In plain English
UK GDPR uses two roles. The controller decides why and how personal data is used: for your clients’ and staff’s details, that’s usually your business. A processor handles the data for the controller and on its instructions: your payroll bureau, your cloud storage provider, or an AI service that summarises your emails.
When you use a processor, the law says there must be a written contract between you covering certain points, including following your instructions, keeping the data secure, only using other suppliers with your permission, and deleting or returning the data at the end. That contract is the DPA. Large providers usually build it into their terms. Microsoft, for example, has a Data Protection Addendum that forms part of the agreement for its business services, Copilot Chat included.
Using a processor doesn’t hand over your responsibility. You’re still accountable for choosing one that can look after the data properly.
An example from a small business
Say a hypothetical 10-person law firm wants an AI tool to transcribe and summarise client meetings. Before anyone signs up, the practice manager reads the provider’s terms. The business plan comes with a DPA, says customer data isn’t used to train its models, and lists the other companies it relies on. The free version has none of that. The firm chooses the business plan and tells staff the free version isn’t to be used for client work.
What to watch out for
- No DPA, no client data. If a service doesn’t offer one, or only its consumer version is on offer, don’t use it with personal data.
- Read what it says about training. Check whether your data could be used to improve the provider’s models, and whether that’s off by default.
- Check sub-processors and location. Most AI services rely on other companies, and data may be processed outside the UK. The terms should name them and the safeguards that apply.
- Check security and deletion. The contract should say how the data is protected and that it’s deleted or returned when you stop using the service.
This is general information, not legal advice. The ICO’s guidance on controllers and processors is a good place to start, and your solicitor can advise on your own contracts.
Related terms
- Shadow AI: staff using tools that have no DPA at all.
- Large language model (LLM): the AI your data is sent to.
- Microsoft 365 Copilot: an AI tool already covered by Microsoft’s terms.
Where AlphaOps can help
We build with Anthropic’s Claude through its business service, which doesn’t train on customer data and is covered by a data processing agreement, and we never use consumer chatbots with client data. Every free automation audit report covers the data-protection points for each automation we suggest. See AI consultancy for more.