# Private AI and UK GDPR: a checklist for firms > What to check before running an open-weight AI model on client or staff data: lawful basis, DPIAs, processors, transfers, model licences and security. Source: https://wharfcloud.co.uk/guides/private-ai-uk-gdpr · Last updated 21 October 2026 · WharfCloud Published 21 October 2026. Reading time about 8 minutes. ## Short answer Running an open-weight model on a dedicated server keeps prompts and documents out of third-party AI services, but UK GDPR still applies to what you put into it. Before you start: identify the personal data involved and your lawful basis, do a data protection impact assessment if the use is likely to be high risk, put a processor agreement in place with whoever hosts the server, know where the server is and whether data leaves the UK, check the model's licence allows your use, and secure the endpoint like any other system holding client data. The ICO's guidance on AI and data protection is the reference. ## What a private model does and does not solve With a public AI assistant, your prompts and uploaded files go to the provider and are handled under its terms. With a private server, the model runs on hardware dedicated to you and nothing is shared with a model provider. That removes one processor from the picture and gives you control over retention and access. It does not remove your obligations. If you feed client files, staff records or customer emails into the model, you are processing personal data and UK GDPR applies exactly as it does to your document management system. ## The checklist 1. **Map the data.** List what will go into the model: which documents, which categories of person, whether any special category data (health, for example) is involved. Keep it to what the task needs. 2. **Choose a lawful basis.** For most internal business uses this is legitimate interests or contract, documented with a short assessment. Your existing privacy notice may need a line about the new use. 3. **Decide whether you need a DPIA.** UK GDPR requires a data protection impact assessment where processing is likely to result in a high risk. The ICO lists innovative technology such as AI among the factors that point towards one. If in doubt, do a short one: it is also the best way to think the project through. 4. **Put a processor agreement in place.** Whoever hosts and manages the server for you is your processor. You need a written contract covering the Article 28 terms: instructions, confidentiality, security, sub-processors, deletion and audit. 5. **Know where the data is.** Record the hosting location. If the server or any support access is outside the UK, check that the transfer is covered, for example by adequacy regulations or the UK International Data Transfer Agreement or Addendum. 6. **Check the model licence.** Open-weight models are released under different licences. Some use standard open source licences such as Apache 2.0; others use custom terms with use restrictions or user thresholds. Read it before you build on it. 7. **Secure the endpoint.** Require authentication on every request, restrict access by network where you can, log who used it, and decide how long prompts and outputs are kept. Treat the server like any other system holding client data. 8. **Keep a human in the loop.** Where outputs inform decisions about people, make sure a person reviews them. The ICO's guidance covers fairness, accuracy and individual rights in detail. ## Individual rights still apply If someone makes a subject access request, personal data held in prompts, outputs and logs on your AI server may be in scope. Short, deliberate retention periods make this far easier to handle, which is one more reason to decide them at the start. ## Hourly GPU or a dedicated server? For experiments with public or synthetic data, renting a GPU by the second is cheap and flexible. For anything that touches client data day to day, a dedicated, managed server with a processor agreement, fixed location and controlled access is easier to justify in a DPIA. We offer both: [hourly GPU](https://wharfcloud.co.uk/gpu) from a prepaid balance, and a managed [Private AI server](https://wharfcloud.co.uk/private-ai-server) at a fixed monthly price, covered by our [data processing agreement](https://wharfcloud.co.uk/legal/dpa). ## Frequently asked questions ### Do I need a DPIA to use AI on client data? You need one where the processing is likely to be high risk. The ICO treats AI as an innovative technology that often points that way, so many firms do a DPIA for any AI use involving client personal data. ### Is a self-hosted model automatically GDPR compliant? No. It can make compliance easier by keeping data with fewer parties, but lawful basis, transparency, security, retention and individual rights still need to be handled. ### Can open-weight models be used commercially? Many can, but licences differ. Some are under standard open source licences; others have custom terms with restrictions. Check the licence of the exact model version you deploy. ## Sources - [ICO: Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/) - [ICO: Data protection impact assessments](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/) - [ICO: International transfers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/) - [ICO: Contracts and liabilities between controllers and processors](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/) --- WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered. Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends. Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact