Glossary
AI and UK GDPR, in plain English
The terms you'll meet when your team uses AI tools with client data, each in a sentence or two, with a link to the guide that says more.
Last checked .
- Business plan and personal plan
- A business plan is the version of an AI tool sold to firms, with a contract and a data processing agreement, and usually no training on what's typed. A personal plan (including free ones) is for individuals, with no contract with your firm.
- Controller and processor
- The controller decides why and how personal data is used: usually your firm. A processor handles it on the controller's instructions, such as an AI provider on a business plan.
- Data processing agreement
- The contract between a controller and a processor that sets out how the processor may use the personal data. Business AI plans come with one; personal plans don't. Is your AI tool safe for client data?
- DPIA (data protection impact assessment)
- A written risk assessment of a new use of personal data, its risks to people, and what you'll do about them. The ICO says most uses of AI need one. Free AI DPIA template
- Hash chain
- A way of linking each log entry to the one before it, so any change to an earlier entry shows up. Saiela's audit log uses one, so you can check nothing has been changed. How Saiela keeps records safe
- Lawful basis
- The legal reason you have for using personal data, such as a contract, a legal obligation or legitimate interests. UK GDPR needs one for everything you do with personal data, and you should write it down.
- Legitimate interests
- A lawful basis for using personal data when you have a genuine reason, the use is necessary, and it doesn't override the person's own interests. You show this with a short balancing test.
- Personal data breach
- A security incident that leads to personal data being lost, destroyed, changed, or shared with someone who shouldn't have it. Every breach must be recorded, and the serious ones reported to the ICO within 72 hours. Breach deadline calculator
- Placeholder
- A stand-in such as [PERSON_1] that Saiela puts in place of a real personal detail before a prompt is sent. The real detail goes back in when the answer arrives, on your screen only. How swap and restore works
- Prompt
- What you type or paste into an AI tool: your question or instruction, plus any text you add to it.
- Pseudonym
- A code that stands in for a person's name, so a record doesn't say who they are on its face. Saiela's audit log shows people as IDs, not names. How Saiela handles your data
- Records of processing
- Your written record of what personal data your firm uses, why, who you share it with and how long you keep it. Add your AI providers to it. AI risk register template
- Shadow AI
- AI tools a team uses for work without the firm knowing or approving them, such as a personal ChatGPT account.
- Special category data
- The most sensitive kinds of personal data, such as health, ethnicity, religion, sexuality, political views, trade union membership, genetic and biometric data. It needs extra care and an extra legal condition.
- Transfer risk assessment
- A check that personal data sent outside the UK is still properly protected in the country it goes to. You may need one if an AI provider stores data abroad.
General information, not legal advice.
Stuart Kinsey
Co-founder of SimpleKPI
Stuart has worked in creative and analytical services for over 25 years and co-founded SimpleKPI in 2007. He writes about how small firms can use AI safely and what UK data protection law expects.
Let your team use AI. Keep the proof.
Try every Team feature free for 7 days.