By Phil Gee · AI Academy, Southport
If you've started using AI tools in your business — or you're sending outreach emails to prospects — you've probably wondered whether you're accidentally breaking data protection law. The good news: for most small businesses, staying on the right side of GDPR is simpler than it sounds. Here's the plain-English version.
The One-Sentence Version
If you collect, store, or use anyone's personal info — names, emails, phone numbers — you need their permission (or a good reason), you need to keep it safe, and you need to be able to tell them what you've got and delete it if they ask.
That's it. Everything else is detail.
Six Things That Actually Matter For a Small Business
- Only collect what you actually need. Don't ask for a date of birth if you never use it.
- Get real consent. No pre-ticked boxes or buried small print.
- Have a plain-English privacy policy explaining what you collect and why.
- Keep data secure — password-protected systems, no client spreadsheets flying around by email.
- Let people unsubscribe and delete their data on request.
- Don't hoard data forever. If someone's gone quiet for a couple of years, let it go.
What You Can Safely Ignore
This is enterprise territory, not yours: formal Data Protection Impact Assessments, SOC 2/ISO 27001-style audits, appointing a Data Protection Officer. If you're a small business, none of that is aimed at you.
Using AI to Research Prospects — Where's the Line?
Looking someone up before a sales call is normal business practice and generally fine under GDPR's "legitimate interest" basis.
Where it gets risky: pasting personal details into free AI tools (that data may leave your control), or building permanent profiles on people.
Simple test: if you'd be comfortable telling the person "I looked you up on AI before our call," you're probably fine.
Free vs Paid AI Tools — Does Paying Buy You Privacy?
Not automatically. Free tiers usually train on your conversations by default. Paid individual plans (like ChatGPT Plus or Claude Pro) often still do too, unless you manually opt out — paying gets you speed and features, not automatic privacy.
Real no-training guarantees typically come with business/team tiers, backed by an actual contract.
Rule of thumb: don't assume — check your settings.
What This Means If You're Running Email Outreach
Beyond general GDPR, UK marketing emails are also covered by PECR (the Privacy and Electronic Communications Regulations). B2B outreach to named business contacts has more legal leeway than consumer cold-emailing, but every marketing email still needs a working unsubscribe link.
A Good Next Step
Policies shift often, and even the experts don't always agree on the fine print. If you want a live, up-to-date answer for your specific situation, try setting up a dedicated AI project with the current privacy policy or ICO guidance loaded in, and ask it your exact question.
Cheaper and faster than a compliance consultant, and a genuinely good use of AI for a small business.