Nobody talks about this bit. Everyone is busy sharing prompts and tool recommendations. Almost nobody is telling you what actually goes into these tools, where it ends up, and what that means for your business legally.
I am going to. Because the GDPR side of AI is the part most founders are quietly hoping does not apply to them. It does. And it is not complicated once someone shows you where the lines are.
You do not need to panic. But you are a data controller. That is a specific legal thing that means you are responsible for the personal information that runs through your business. AI does not change that. It just gives you faster ways to get it wrong.
Here are the three mistakes I see most.
Mistake one: pasting client data into a tool you have not checked
This is the one that catches almost everyone. You have a client email, some call notes, a spreadsheet with names and numbers. You paste the whole thing into a chatbot and ask it to tidy it up.
The problem is not using AI. The problem is handing someone else’s personal data to a company you have not checked, possibly to be stored on a server in another country, possibly used to train a model. Under UK GDPR you needed a lawful basis for that and a data processing agreement in place. Most people have neither.
The fix is not to stop using AI. It is to know your tool. Some let you turn off training on your data. Some process everything locally so nothing leaves your machine.
I worked with someone supporting a barrister. He was drowning in case summaries and firmly anti-AI, for obvious reasons given what he handles. I did not push a chatbot at him. I recommended local-processing dictation software. Nothing sent off. Nothing stored. GDPR-safe from day one. He tried it that day and his old setup was obsolete by the end of the week. The right tool for sensitive data is rarely the loudest one.
Mistake two: no record of what you are actually using
Ask yourself a quick question. Which AI tools are currently touching your business? All of them. Can you name them?
Most founders cannot, because it has crept in. A bit of ChatGPT here. A transcription tool there. A note-taker that quietly joined your last three calls and recorded everything.
You cannot protect data you have not mapped. If a client asks what happens to their information, I am not sure is not the answer you want to give.
The fix takes an hour. Write down every tool that touches client or customer data. What goes in. Where it goes. Whether it trains on your inputs. That is it. Boring, yes. But the difference between being in control and hoping for the best.
Mistake three: letting AI quietly record people without telling them
The meeting note-takers are everywhere now. They join calls, record, transcribe, summarise. Genuinely useful. Also recording another human being, often without them being asked.
If you are recording a client or a collaborator, they should know. Consent is not optional here. A note-taker quietly sitting in on a call and capturing every word is a data problem dressed up as a productivity tool.
The fix is one sentence at the start of every call. I use an AI note-taker, is that alright with you? Done. You keep the tool. You just stop using it on people who never agreed to it.
None of this should stop you
None of this should stop you using AI. The women I work with are not behind on this. Most are ahead and do not know it. The compliance side is not hard once someone shows you the lines. It is just that nobody selling you tools will ever show you them.
That is what we cover in the room on the 7th of July.
Stop Winging It With AI is a small in-person workshop in Dorchester. Ten spaces. Good coffee. The honest version of AI strategy including the legal side most people skip, and proper time for your actual questions.
You leave knowing what you can use, what to check, and what to stop doing. It is £35. Grab your seat here.
Not ready to come along yet? The free Business Foundations Workbook gets your foundations clear first. That is always where this starts anyway.