Update Details: The documents in the GDPR / Data Protection Toolkit have been revised to cover AI use with personal data, retention across every copy and data protection rights.
AI tools are part of everyday office work now. Writing and email assistants, meeting note takers, website chatbots, and AI features built into HR, CRM and accounts software that people often do not realise are there. Where those tools touch personal data the organisation is still responsible for it, and still has to be able to say what is happening to it. The registers, policies, forms, procedure and guidance in the GDPR / Data Protection Toolkit now record that position across the set, and have had a general improvement pass at the same time.
The toolkit has also gained a worked example risk assessment and the data protection staff guidance, so the position runs from the register through to what people are told in a training talk.
How the GDPR Toolkit Documents Record AI Use
- Which tools, and which providers - the personal data registers record AI use against the data, naming the tools and the providers behind them
- Where AI is not permitted - recorded as a deliberate position rather than left blank
- The personal data AI creates itself - prompts and outputs, meeting recordings and transcripts, and chatbot conversation logs, and included when someone asks for a copy of their data
- Retention across every copy - backups, archives and copies held by service providers, including AI service providers
- Approval before use - the procedure sets out how AI tools are approved before personal data is used with them, and what meaningful human review of an automated decision involves
- Impact assessment prompts - for AI tools, and for software that scores, ranks or filters people
- Sub-processors - AI service providers covered by the processing agreement, with a declaration that personal data is not used to train an AI provider's models
- Classification decides what can go in - which classification levels may be entered into an AI tool, and why AI output keeps the classification of its source
- What staff are told - the guidance and training talks cover approved tools only, information entered into an AI tool as a transfer to a third party, and AI output about a person as personal data in its own right
Improvements Across the Data Protection Documents
- Rights in plain English - the privacy notice explains what each data protection right actually means instead of listing them
- Making a request - a full section covering how to ask, the identity check, the timescales, and what happens if more time is needed
- How retention periods are decided - set out in the retention policy, with backups and provider-held copies covered so a retention period means the same thing wherever the data sits
- Acting as a processor - the procedure and the record of processing form now cover working as a processor for someone else, and all of the data protection rights rather than access requests alone
- Editing prompts - yellow prompts through the policies show where to name your own privacy notice, procedure and approved AI tools
Registers Updated:
| F-IMS24 Personal Data Register | Register by data category. Each row now carries a line on AI use where AI tools process that data |
| ER21 Personal Data Register | The Excel register, with AI use recorded alongside the tool and provider, and linked sheets for transfers, requests, breaches and deletion |
| F-IMS30 Record of Processing Activities Register | Register by processing activity rather than by data category, with AI use recorded against each activity |
Policies and Procedure Updated:
| PP-1-16 Data Protection Policy Procedure | Approving AI tools before personal data is used with them, what meaningful human review involves, and handling every data protection right |
| P-25 Data Protection Policy | The assurance statement, now covering the controlled use of AI tools alongside everything else |
| P-26 Privacy Policy | A section describing the AI tools in use, rights explained one by one, a full request process |
| P-84 Website Privacy Policy | The website notice, covering a live chat or AI chatbot among the third parties handling visitor data |
| P-91 Data Retention Policy | How retention periods are decided, and every copy covered including those held by AI service providers |
| P-92 Data Breach Policy | Personal data entered into an AI tool that has not been approved treated as a breach like any other |
| P-93 Personal Data Subject Access Request Policy | Records held in AI tools included when someone asks for a copy of their personal data |
Forms Updated:
| F-Q21 Data Transfer and Processing Agreement | Sub-processors including AI service providers, and a declaration that personal data is not used to train an AI provider's models |
| F-Q73 Personal Data Subject Access Request | Searches extended to records created by AI tools - transcripts, summaries, prompts, outputs and chatbot conversations |
| F-Q74 Personal Data Breach Form | Breach recorded from discovery to closure, with recurring causes such as unapproved AI tools visible across completed forms |
| F-Q97 Data Protection Impact Assessment | A section on AI, and prompts for software that scores, ranks or filters people |
| F-Q99 Record of Processing Form | Single activity record with its own section on AI and automated decisions, and whether the activity is carried out as a processor |
| F-Q106 GDPR Compliance Checklist | AI use and automated decisions as requirements in their own right on the checklist |
Audit Checklists and Risk Assessment:
| A-C_P45 Information Security Personal Data | Checks what a department holds against the register, including whether any of it reaches an AI tool |
| A-C_P47 Information Security Data Protection | Use of AI and automated decisions added to the areas reviewed at internal audit |
| RA-BR11 Data Protection and Privacy | Added to the toolkit. A worked example business risk assessment running from lawful basis and transparency through to AI tools and personal data |
Staff Guidance and Training Talks Updated:
| GG-1-16 Data Protection TT-1-16 Data Protection | Added to the toolkit. Why using an AI tool with personal data is a use of personal data like any other, and why what the tool produces about a person is personal data too |
| GG-8-01 Information Security - General TT-8-01 Information Security - General | Everyday habits, including keeping personal information out of AI tools that have not been approved |
| GG-8-06 Information Transfer TT-8-06 Information Transfer | Information entered into an AI tool treated as a transfer to a third party, often outside the UK |
| GG-8-07 Information Classification and Protection TT-8-07 Information Classification and Protection | Which classification levels may be entered into AI tools, and why AI output keeps the classification of its source |
The toolkit guidance has been updated alongside the documents.
Further guidance is available in our knowledge base;
Data Protection and UK GDPR
Legal and Compliance Obligations for UK Businesses
Both of these can be prepared for you rather than completed in house;
Personal Data Register and Privacy Notice Preparation
AI Policy and Risk Register
