Private AI and UK GDPR: a checklist for firms

With a public AI assistant, your prompts and uploaded files go to the provider and are handled under its terms. With a private server, the model runs on hardware dedicated to you and nothing is shared with a model provider. That removes one processor from the picture and gives you control over retention and access.

It does not remove your obligations. If you feed client files, staff records or customer emails into the model, you are processing personal data and UK GDPR applies exactly as it does to your document management system.

1. 01

   Map the data

   List what will go into the model: which documents, which categories of person, whether any special category data (health, for example) is involved. Keep it to what the task needs.

2. 02

   Choose a lawful basis

   For most internal business uses this is legitimate interests or contract, documented with a short assessment. Your existing privacy notice may need a line about the new use.

3. 03

   Decide whether you need a DPIA

   UK GDPR requires a data protection impact assessment where processing is likely to result in a high risk. The ICO lists innovative technology such as AI among the factors that point towards one. If in doubt, do a short one: it is also the best way to think the project through.

4. 04

   Put a processor agreement in place

   Whoever hosts and manages the server for you is your processor. You need a written contract covering the Article 28 terms: instructions, confidentiality, security, sub-processors, deletion and audit.

5. 05

   Know where the data is

   Record the hosting location. If the server or any support access is outside the UK, check that the transfer is covered, for example by adequacy regulations or the UK International Data Transfer Agreement or Addendum.

6. 06

   Check the model licence

   Open-weight models are released under different licences. Some use standard open source licences such as Apache 2.0; others use custom terms with use restrictions or user thresholds. Read it before you build on it.

7. 07

   Secure the endpoint

   Require authentication on every request, restrict access by network where you can, log who used it, and decide how long prompts and outputs are kept. Treat the server like any other system holding client data.

8. 08

   Keep a human in the loop

   Where outputs inform decisions about people, make sure a person reviews them. The ICO's guidance covers fairness, accuracy and individual rights in detail.

If someone makes a subject access request, personal data held in prompts, outputs and logs on your AI server may be in scope. Short, deliberate retention periods make this far easier to handle, which is one more reason to decide them at the start.

For experiments with public or synthetic data, renting a GPU by the second is cheap and flexible. For anything that touches client data day to day, a dedicated, managed server with a processor agreement, fixed location and controlled access is easier to justify in a DPIA.

We offer both: hourly GPU from a prepaid balance, and a managed Private AI server at a fixed monthly price, covered by our data processing agreement.