The fear that's stopping you using AI
You've heard AI could save you hours a week, but every time you go to try it, a little voice says: what about GDPR? You picture a letter from the ICO landing on the doormat and a fine that wipes out a quarter's profit.
Here's the honest answer: AI isn't automatically a GDPR problem, and it isn't automatically safe either. It comes down to what you put into it and which tool you use. Let's sort the confusion in plain English.
What GDPR actually cares about
UK GDPR isn't some mystical beast. It cares about three things, and that's basically it:
- What personal data you collect: names, addresses, phone numbers, emails, anything that identifies a real person.
- How it's stored: is it secure, or sat in a notebook in your van?
- Who you share it with: including any software or service that processes it on your behalf.
That last point is the one that matters for AI. When you paste a customer's details into ChatGPT, you're sharing their data with OpenAI. Same as when you store their address in Google Drive or send them an invoice through Xero. AI isn't special, it's just another piece of cloud software.
The simple rule: treat AI like any other cloud tool
If you'd happily put it in Dropbox, Google Drive or your accounting software, you can probably put it in a properly set-up AI tool. If you wouldn't, don't.
That's it. That's the rule. The Information Commissioner's Office (ICO) has published guidance on AI and the underlying principles are the same as any other data processor: lawful basis, security, transparency with your customers.
Which AI tools are actually safe for business use
Not all AI tools are equal. The free consumer version of ChatGPT, for example, can use your conversations to train future models by default. That's fine if you're asking it to write a poem about your dog. It's not fine if you're pasting in Mrs Jenkins' address and boiler service history.
For anything involving customer data, you want:
- ChatGPT Team or Enterprise: data isn't used for training, and OpenAI signs a data processing agreement.
- Microsoft Copilot for Business: sits inside your existing Microsoft 365 setup.
- Claude for Work: same deal, business-grade privacy terms.
- Purpose-built tools like AI phone answering services that are designed for UK business use and come with the proper agreements in place.
Using an AI phone answerer to take messages is, legally speaking, no different from using a human virtual receptionist service. Both are third parties handling your customer data on your behalf. Both need a contract. Both are perfectly legal.
What NOT to put into AI tools
Some things just shouldn't go near a chatbot, no matter how fancy the subscription. Keep this lot well away:
- Bank details, card numbers, or payment information
- Passwords or login credentials (obvious, but people do it)
- Medical information about customers or staff
- National Insurance numbers or passport details
- Anything a customer has specifically told you in confidence
If a customer in Lowestoft tells you about a medical condition that's why they need their boiler serviced urgently, don't paste that into ChatGPT to help write the quote. Strip the personal bits out first. A good habit is to swap names for placeholders like "the customer" and addresses for "the property" before you hit send on a prompt.
What's completely fine
Now the good news. Most of the stuff small business owners actually want AI for is totally fine:
- Writing and polishing emails (without pasting in full customer details)
- Drafting quote templates and standard responses
- Answering common questions on your website
- Summarising your own notes from a job
- Generating social media posts
- Building checklists and process docs
If you want a head start on the prompts that actually work for trades and agents, grab our free guide. It's a practical walkthrough, not a sales pitch.
You're on the drive home from a job
You're heading back to Norwich after a kitchen install. You want to fire off three quote follow-ups before tea. You open ChatGPT on your phone, type "write a polite follow-up to a customer who hasn't responded to a £4,200 quote for a bathroom refit" and it gives you a solid draft in ten seconds. No customer name. No address. No personal data. That's completely fine.
According to ICO research, the vast majority of small business data breaches reported each year come from basic stuff like lost laptops, dodgy passwords and phishing emails. Not from AI tools. The biggest risk to your data is almost certainly still the sticky note on your monitor with your email password on it.
What about your customers? Do you need to tell them?
Short answer: yes, and it's easier than you reckon. Your privacy policy on your website should mention that you use third-party tools to help run the business, including AI-assisted software for things like drafting communications or handling enquiries. You don't need to list every tool by name. You do need to be honest that data may be processed by them.
If you're using AI to answer your phone or reply to enquiries automatically, a one-line mention on your contact page is spot on: something like "calls and messages may be handled with the help of AI tools to make sure we get back to you quickly." Job done. Customers in Ipswich and Great Yarmouth aren't going to bat an eyelid, they just want their leaky tap sorted.
Your 10-minute quick win
Right now, go to ico.org.uk and check whether your business is registered with the ICO. If you handle any customer data (and you do, phone numbers count), you almost certainly need to be. It costs between £40 and £60 a year for most small businesses, and it's a legal requirement. Takes about ten minutes to sort. Do it before you worry about AI, because that's the bit the ICO actually checks first.
Stop guessing, start doing
Want straight-talking tips like this every week, written for trades and agents in Norfolk and Suffolk who'd rather be on the tools than reading legal jargon? Sign up to the Axlo newsletter. Lands every Thursday, takes five minutes to read, and never tries to flog you anything you don't need.