Privacy notice for a company using AI tools on customer data

A business that runs customers' personal data through AI tools (a support chatbot, a scoring model, a generative assistant, an analytics product that profiles) has to tell customers that it does: what the tools do with the data, who provides them, whether the data trains them, and what rights the customer has where a tool makes or shapes a decision. The notice also has to rest on a lawful basis and an impact assessment, and it has to be accurate about what the tools do, which the business has to find out from the providers. I draft the privacy notice and the cookie notice for the business, with guidance on the consent mechanism, for a fixed fee of £595, delivered in five working days.

Who this is for

Businesses in England and Wales using AI tools on customer, client or user data, from a chatbot on the website to a model that scores applications, and businesses whose suppliers have added AI features to products they already use.

What matters in a privacy notice for AI use

What the notice has to say about AI that it did not have to say before

The business, as controller, owes a duty under Article 13 of the UK GDPR to tell customers the purposes and lawful basis of processing and the recipients of their data, which for AI tools means saying that the data is processed by an AI tool, what the tool does (answers queries, summarises, scores, recommends, generates), who provides it, and under Article 13(2)(f) where automated decision-making or profiling is involved meaningful information about the logic involved and the significance and consequences; the notice should name the categories of tool and what each does in plain terms, as the Information Commissioner's AI guidance expects.

The AI providers, the contracts and the question of training

Each AI provider is a processor under Article 28 of the UK GDPR where it processes the business's data on instructions, and the business should hold a data processing agreement with each that says whether the provider may use the data to train or improve its models (many terms permit it unless the business opts out, which makes the provider a controller for that purpose and the business responsible for having allowed it), where the data is processed and for how long it is retained; the notice should state whether customer data trains the business's or the providers' models, and the business should have turned training off or obtained a basis for it, because a notice contradicted by the provider's terms has misstated the position.

Automated decisions, profiling and the rights that attach to them

Where an AI tool takes a decision with legal or similarly significant effects for the customer (refusing an application, pricing, closing an account) solely by automated means, Article 22 of the UK GDPR applies as amended by the Data (Use and Access) Act 2025, which permits such decisions outside special category data where safeguards are in place (the customer is told, can make representations, can obtain human intervention and can contest the decision), and the notice should say which decisions are automated, which are recommended by a tool and taken by a person, and how the customer exercises the safeguards; profiling short of a decision still needs transparency, a lawful basis, and the right to object under Article 21.

The lawful basis, the impact assessment and the accuracy the law requires

The business needs a lawful basis for each AI use (the contract under Article 6(1)(b) where the tool delivers the service, legitimate interests under Article 6(1)(f) for support, analytics and improvement with the interest stated and the balance recorded, consent where the use is optional or intrusive), a data protection impact assessment under Article 35 where the use is likely to result in a high risk (profiling, automated decisions, new technology on a large scale, special category data), and attention to the accuracy principle under Article 5 (an AI tool that generates inaccurate information about a customer is processing inaccurate personal data); the notice states the basis for each use and the business holds the assessment.

Special category data, children and the uses to avoid

Running special category data through an AI tool needs a condition under Article 9 of the UK GDPR and Schedule 1 to the Data Protection Act 2018 and a provider whose terms and security match, inferring special category data from other data is itself special category processing, and AI tools used on children's data engage the age appropriate design code under section 123 of that Act; the notice should say which special category data the tools touch and the condition relied on, and the business should avoid uses it cannot explain, because enforcement on AI has focused on uses that were never assessed.

Transfers, retention and the data that goes into a model

Most AI providers process outside the United Kingdom, so the notice should state the transfers and the safeguards under Article 46 of the UK GDPR, the retention of prompts, outputs and logs by the business and by the providers (which the data processing agreement should limit), the position of data already used to train a model (which cannot be removed from it), and the customer's rights (access, rectification, erasure, restriction, portability, objection), how to exercise them, the one-month time limit, and the right to complain to the Information Commissioner's Office; the website's chatbot and analytics tools need the consent mechanism under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 where they store or access information on the device, and the Data Protection (Charges and Information) Regulations 2018 require registration with the Information Commissioner's Office where the fee applies, and the notice can give the number.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

We use a chatbot on our website. Does the privacy notice have to mention it?

It does: that customer messages are processed by an AI tool, who provides it, what it does with them and whether they are used for training. The chatbot's tracking also needs cookie consent if it stores information on the device.

Our AI provider's terms let it train on our data. Is that a problem?

It makes the provider a controller for training and the business responsible for allowing it. Turn training off in the settings or the contract, or obtain a basis for it, and make sure the notice says what is true.

Our tool scores applications automatically. What rights do customers have?

To be told, to make representations, to obtain human intervention and to contest the decision, under Article 22 as amended by the 2025 Act, which the notice explains. A decision the business cannot explain should not be automated.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a SaaS product
• Privacy notice for a recruitment platform

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.