Using AI in Your Accountancy Practice: What GDPR Means for You

UK accountancy practices handle some of the most sensitive personal data in professional services: National Insurance numbers, income figures, tax records, and financial details that clients trust you to protect. When you introduce AI tools into that environment, UK GDPR obligations do not pause. They apply, and in some areas they create specific requirements that many practices have not yet thought through.

This article is part of Runbook's complete guide to AI implementation for UK accountancy practices. It covers what UK GDPR actually means for your practice when using AI: where the obligations sit, what to check before using any AI tool with client data, and how to build a defensible approach without needing a full-time data protection team. If you want to know how your practice currently stands across data, tools, and readiness, the free AI Readiness Scorecard gives you a personalised picture in under five minutes.

Why GDPR matters specifically when using AI tools

UK GDPR does not contain a section on artificial intelligence. What it contains is a framework for the lawful processing of personal data, and that framework applies regardless of which technology you use to process it. When you paste a client's income details into an AI assistant to draft a covering letter, you are processing personal data. When you upload a set of meeting notes containing client names and financial figures to a transcription tool, you are processing personal data. The obligations that follow are the same as they would be for any other processing activity.

The reason AI creates specific risk for accountancy practices is the nature of how most AI tools work. Many general-purpose AI products, particularly on their free tiers, use input data to improve their models. This means information you submit may be stored, reviewed, and used in ways that go well beyond producing a response to your query. For personal data belonging to your clients, that creates a direct problem under UK GDPR, because you have no contract in place governing how that third party processes the data, and you cannot demonstrate that the processing is lawful.

This does not mean AI tools are off-limits for accountancy practices. It means they require the same due diligence you would apply to any other supplier that handles client data. The key steps are straightforward once you know what to look for.

Data processing agreements: the non-negotiable

Under UK GDPR, when you share personal data with a third-party organisation that processes it on your behalf, you must have a written data processing agreement (DPA) in place with that organisation. Where a processor relationship exists, this is not optional. Article 28 of UK GDPR sets out the requirement explicitly, and the Information Commissioner's Office (ICO) expects controllers to be able to demonstrate compliance.

A data processing agreement must cover, at a minimum: the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects involved, and the obligations and rights of the controller. Critically, it must restrict the processor from using the data for any purpose other than the one you have specified.

Most free-tier AI tools do not include a DPA. This is not a minor technicality. It means that if you input client personal data into a tool where no DPA exists, you are sharing personal data with a third-party processor without the contractual protections Article 28 of UK GDPR expects. This creates a significant compliance risk: in the event of a data incident, the ICO would look for evidence that appropriate agreements were in place, and their absence would be difficult to justify to regulators.

What to check before using any AI tool with client data

Before inputting any client personal data into an AI tool, confirm the following:

• Does the provider offer a DPA? This is typically available on business or enterprise plans. Check the provider's legal or privacy documentation, not just the marketing page.
• Does the DPA cover UK GDPR specifically? Many providers offer GDPR-aligned agreements that address the UK position, but confirm this rather than assuming. Post-Brexit, UK GDPR is a separate legal instrument from EU GDPR, though they are largely aligned in practice.
• Does the agreement prohibit the provider from using your data to train their model? This should be stated explicitly. If it is not clear, contact the provider's legal or compliance team before proceeding.
• Where is the data stored and processed? UK GDPR places restrictions on transfers of personal data outside the UK to countries that do not have adequate data protection standards. Most major AI providers process data in the US and commonly rely on mechanisms such as the UK-US data bridge or standard contractual clauses to legitimise these transfers, though the specific mechanism varies by provider. Check which applies in your case and that it remains current.

Confirming a DPA is in place addresses one significant requirement, but compliant use also depends on data minimisation, appropriate security measures, and a clear lawful basis for the processing itself.

Which AI tools are appropriate for use with client data

The short answer is: paid business plans from the major providers, with a signed DPA in place. The free-tier versions of most AI tools are generally not appropriate for processing identifiable client information and unlikely to meet compliance expectations without a DPA in place. The following is a summary of the position for the tools most commonly used by UK accountancy practices. This reflects the position as of April 2026 and should be verified directly with each provider, as terms change.

ChatGPT (OpenAI)

ChatGPT Free does not include a DPA and, by default, uses conversation data to improve OpenAI's models. It is high risk and difficult to justify under UK GDPR for processing client personal data. ChatGPT Business (formerly Team) and ChatGPT Enterprise both include DPAs and opt out of using your inputs for model training. If your practice uses ChatGPT with client data, it must be on a ChatGPT Business or Enterprise plan with a signed DPA.

Microsoft Copilot

Microsoft Copilot for Microsoft 365 (the version integrated into Word, Outlook, and Teams) operates within Microsoft's commercial data protection framework, which includes a DPA and a commitment not to use your data to train foundation models. This addresses one key requirement and enables compliant use when combined with appropriate controls (including data minimisation, security measures, and a clear lawful basis), making it one of the more straightforward options for practices already using Microsoft 365 Business or Enterprise licences. The free Copilot available at copilot.microsoft.com does not carry the same protections and is generally not appropriate for use with client data.

Claude (Anthropic)

Anthropic's Claude paid business and enterprise plans include a DPA and commit to not using your data for model training. The free Claude.ai plan does not include a DPA and is generally not appropriate for processing client personal data. As with the other tools, the distinction between consumer and business plans is the critical one.

AI features within accountancy software

AI features built into platforms such as Xero, QuickBooks, and Sage operate within those platforms' existing data processing frameworks, which you will already have agreed to as part of your software subscription. These are generally a lower operational risk starting point for AI-assisted data work and typically easier to justify due to the existing contractual framework: the data does not leave your existing software environment and the provider's obligations are already documented in your subscription agreement. That said, it is still worth reviewing how AI features within your software use your data, as terms vary by platform and product update.

For a detailed, plan-by-plan comparison of what ChatGPT and Microsoft Copilot offer on data protection, alongside pricing and practical use-case guidance for UK accountancy practices, read the full guide to ChatGPT vs Microsoft Copilot for UK accountants.

Lawful basis and what it means in practice

Having a DPA with your AI provider addresses one part of the UK GDPR picture. The other part is your own lawful basis for processing the client data in the first place. Under UK GDPR, every processing activity needs a lawful basis, as set out in Article 6. For accountancy practices, the most relevant bases are contract, legal obligation, and legitimate interests.

Processing under contract

Most of the personal data you hold for clients is processed under contract: you need it to provide the services set out in your engagement letter. Using AI tools to draft communications or summarise documents as part of delivering those services is likely to be covered by the same basis, provided the AI use is proportionate and the data is handled securely. The key question is whether using a particular AI tool for a particular task is reasonably necessary to provide the contracted service, or whether it goes beyond what the client would expect.

Legitimate interests

Where processing does not fit neatly under contract or legal obligation, legitimate interests may apply, but it requires a Legitimate Interests Assessment (LIA) to demonstrate that your interest is not overridden by the rights of the individuals whose data you are processing. You must demonstrate that your interest in using the AI tool is legitimate, that the processing is necessary for that purpose, and that it does not override the data subject's rights and interests. For routine internal drafting tasks where client data is processed minimally and securely, this test is generally straightforward to pass. For more intensive uses of client data, the assessment requires more care.

Should you update your privacy notice?

Probably yes, if you have not done so already. UK GDPR requires your privacy notice to describe the categories of recipients to whom you may disclose personal data, including processors. If you are now using AI tools as data processors, and those tools are not currently referenced in your privacy notice, you should review and update it. This does not require client consent; it requires transparency. A brief addition noting that you may use secure AI processing tools to assist with internal drafting and administration, subject to appropriate data protection safeguards, is typically sufficient.

Building a defensible AI data policy for your firm

A written AI data policy is not just a compliance document. It is the primary mechanism for ensuring that everyone in your practice handles AI tools consistently and safely. Without one, individual staff members make their own judgements about what is and is not acceptable, which creates inconsistent risk across the practice.

The policy does not need to be long. A two-page document that covers the following areas is sufficient for most practices of under 50 staff.

What your AI data policy should cover

• Approved tools: A list of the AI tools your practice has approved for use, specifying which tools are permitted for tasks involving personal data and which are for internal use only (for example, drafting documents that contain no client-identifiable information).
• Data categories: A clear statement of what categories of data can and cannot be processed using AI tools. As a starting point: no National Insurance numbers, no tax reference numbers, no bank account details, and no full client names combined with financial figures, unless processed within a tool with a signed DPA specifically approved for that purpose.
• DPA confirmation: A record of which tools have signed DPAs in place, who is responsible for reviewing those agreements, and when they were last checked.
• Review obligations: A requirement that all AI-generated output that will reach a client or a regulatory body is reviewed by a qualified person before use. This applies without exception.
• Incident reporting: A clear process for reporting suspected data incidents involving AI tools, consistent with your existing ICO reporting obligations under UK GDPR (72-hour notification for breaches likely to result in risk to individuals).

Once you have a policy, the next step is making sure staff understand it and follow it consistently. Brief team training does not need to be formal. A 30-minute team meeting covering the policy, the list of approved tools, and a clear instruction on what not to do will address most of the practical risk for a small practice.

The AI Implementation Checklist for UK Accountancy Practices includes a policy template covering each of these areas, along with guidance on tool selection and a 90-day rollout plan for structured adoption across your team.

If you are not yet sure where your practice stands on data readiness, tool selection, or policy, the free AI Readiness Scorecard assesses your practice across the key areas and shows you where to focus first. It takes under five minutes and produces a personalised result with no sales call required.

Frequently asked questions