Home › AI on email and GDPR
Worried AI on your email breaks GDPR?
"Is it even allowed?"
- Customer names and addresses are in your inbox
- You don't know where the AI sends your data
- You've heard AI trains on what you type
- You don't want a letter from the ICO
These are fair questions. Here are plain answers.
Five plain points for a small business.
- Have a lawful reasonKnow why you use the data. See the ICO on lawful basis.
- Tell peopleYour privacy notice should say you use an AI tool to help handle messages.
- Use only what's neededGive the tool the least access it needs.
- Pick providers with proper termsRead their data terms before you connect anything.
- Pay the ICO fee if it appliesMost businesses that handle personal data must. Check the ICO data protection fee page.
The ICO has a hub for small organisations.
Questions to ask any AI provider.
- Does it train on my data? Can I turn that off?
- Where is my data stored, and for how long?
- Who at the provider can see it?
- Can it send emails on its own, or only draft?
- How do I disconnect it?
Training, storage and access.
Look for a training or "improve the model" switch and turn it off where offered. Check how long chats are kept. Connect only the accounts you need. Policies change, so check on the day you set it up.
Never put bank details, health information or passwords into an AI tool unless the tool and your contract are cleared for it.
Draft-only, on your own accounts.
You type every password. I never see one. It drafts, you send. Training switches are turned off together where a tool has them. You get a plain-English safety pack. See the set-up for builders and trades, our privacy notice, and will AI send emails without me?
This is guidance, not legal advice. Gotts Consultancy is not a law firm. If you handle sensitive data, ask a data protection professional.
Straight answers.
Is it legal to use AI on my business email under UK GDPR?
It can be, if you have a lawful basis, tell people in your privacy notice, use a provider with proper data terms and limit what it can access. This is guidance, not legal advice.
Does the AI train on my emails?
It depends on the provider and your settings. Check their data terms and turn training off where offered. Policies change, so check on the day.
Do I need to update my privacy notice?
Usually yes, to say you use an AI tool to help handle messages.
What should I never put into AI?
Bank details, health information and passwords, unless the tool and your contract are cleared for it.
Is this legal advice?
No. It is plain-English guidance. For your own situation, read the official ICO pages or ask a professional.
More help with the admin.
Less admin. More time to grow.
Free. 15 minutes on video. I'll tell you straight if it fits, or if it doesn't.
Or call 07368 870437 or email alex@gottsconsultancy.com.