AI data protection and UK GDPR: a guide for advice firms

Advice firms hold some of the most personal information any business can: income, health, family circumstances, attitudes to money and, increasingly, recordings of the conversations where all of that is discussed. Using AI with that information is now an everyday question rather than a future one. Getting AI data protection right under UK GDPR is mostly a matter of doing familiar things in the right order, with the right records.

This guide covers what the ICO (since 30 September 2026, the Information Commission) expects, how the FCA's position sits alongside it, and a practical plan a small or mid-sized firm can follow. It is general guidance for firms, not legal advice; take specialist advice where your circumstances need it.

The regulators' positions in brief

The ICO

The ICO's guidance on AI and data protection is the main reference. It currently carries a banner saying it is under review following the Data (Use and Access) Act, so check it for updates before relying on any detail. Two passages are central for advice firms:

"In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk… and will therefore trigger the legal requirement for you to undertake a DPIA."

"it is your responsibility to decide which lawful basis applies"

Firms must also decide and document whether each AI provider acts as a controller or a processor.

The FCA

The FCA has not written AI-specific rules. Its AI Update (22 April 2024, updated 3 December 2025) relies on the Consumer Duty, SM&CR and SYSC. In a blog of 8 June 2026, it said it will "rely on existing frameworks, including the Consumer Duty, the Senior Managers and Certification Regime (SM&CR), and our expectations on governance and controls."

So the two regulators point the same way. The ICO asks you to assess and document the data risk; the FCA expects that work to sit inside your normal governance, with a senior manager accountable for it.

A four-step plan for AI data protection under UK GDPR

Step one: map the data

You cannot assess what you have not mapped. For each AI tool, write down:

• what client data goes in (documents, recordings, transcripts, questionnaire answers);
• which organisations receive it, including the software vendor, the AI model provider and any recorder or transcription service;
• where each one stores and processes it;
• how long each keeps it, and how it is deleted;
• whether any party may use it for model training, and whether that is a default or a setting.

Be precise. With IFA Tools, for example, the apps run on the firm's computers, documents are read on the computer and the content the AI needs is sent to the Claude or ChatGPT account the firm chose. The meeting apps connect to Fireflies, and Carbon and Freeboard can connect Google. IFA Tools does not hold the firm's client data, but the AI provider and Fireflies both belong on the map. Hosted platforms have a different map, with the vendor's service at the centre. Our article on where client data goes with AI tools sets out both designs.

Step two: the DPIA

Given the ICO's wording, the sensible default is to carry out a DPIA before any AI tool touches client personal data. A proportionate DPIA for an advice firm usually covers:

1. The purpose. What job the tool does, such as drafting a review or checking a file, and why AI is used for it.
2. The data. The categories of client data involved. Meeting recordings and fact finds may contain health and family information, which deserves particular care in the assessment.
3. Necessity and proportionality. Whether the tool needs all the data it receives, and whether less would do.
4. The risks to clients. For example inaccurate outputs reaching a client, data held longer than needed, or data used for purposes the client would not expect.
5. The controls. Contracts, training settings, access controls, human review, retention and deletion.
6. Sign-off. Who approved it, when, and when it will be reviewed.

Keep the DPIA alive. Review it when the tool, the AI provider or the way you use it changes.

Step three: lawful basis and roles

Lawful basis. The ICO is clear that choosing the lawful basis is the firm's responsibility. Record the basis for each use, and check it matches what your privacy notice tells clients. If clients would be surprised to learn a tool is used, that is a sign the notice needs updating.

Controller or processor. For each party in your data map, decide and document its role. Many software vendors act as processors for their customers, but do not assume it: read the terms. Where a firm holds its own account with an AI provider, as with IFA Tools, the firm reviews that provider's terms directly. Where a hosted platform uses AI providers on your behalf, ask the vendor how those providers are engaged and listed.

Step four: training settings and contracts

Model training is one of the most common questions from clients and compliance teams. Settings differ by provider and plan. For example, Anthropic's pricing page (seen 7 October 2026) says its Team plan has "No model training on your content by default", while on its consumer plans model training is opt-out. Several adviser platforms publish their own commitments: Aveni's Trust & Security page says customer data is "never used to train our AI systems or those of any third-party AI provider", and Timeline says customer data is never used to train AI models in Pennee.

Whatever the position, record it in the DPIA, keep a copy of the terms you relied on, and diary a date to check them again.

Where data protection meets Consumer Duty

Data protection and conduct meet at the output. Under PRIN 2A.2.8R, "A firm must avoid causing foreseeable harm to retail customers." An AI-drafted document that reaches a client with a wrong figure or a misunderstood circumstance is a foreseeable harm. Practical controls include:

• a named reviewer for every AI-drafted client document;
• tools that show the source of each figure or finding, so review is quick and real;
• a short written policy on what staff may and may not put into AI tools;
• a record of which tool and which version produced each output, where that matters for later review.

For assessments of advisers or clients, a dated, versioned standard makes later review much easier. Freeboard, for instance, scores against a versioned, dated standard and quotes the client's own words for every conclusion, so a supervisor can see what each judgement rested on.

A one-page checklist

For the supplier side of this work, use our AI vendor due diligence checklist.

Frequently asked questions

Does UK GDPR stop advice firms using AI with client data?

No. It requires the firm to assess and document the processing, choose a lawful basis, define each party's role and protect clients. The ICO expects a DPIA in the vast majority of AI uses.

Has the FCA issued AI-specific rules?

No. The FCA has said it relies on existing frameworks, including the Consumer Duty and SM&CR, and its expectations on governance and controls.

Is the ICO's AI guidance final?

The guidance carries a banner saying it is under review following the Data (Use and Access) Act. Check the ICO's page for updates before finalising your DPIA.

To see how a versioned standard and quoted evidence look in practice, read about Freeboard or book a demo: twenty minutes on Teams with Adam Booth, on a demo firm, with nothing to prepare.