AI has obvious appeal for advice firms — faster reports, less admin, more capacity — but it runs straight into one of the profession’s most sensitive obligations: protecting client data. Financial advisers handle exactly the kind of detailed personal and financial information that UK GDPR is designed to safeguard, so any tool that processes it has to be chosen and used with data protection front of mind.
This guide sets out what financial advisers need to know about AI and GDPR: where the obligations sit, what to check before a tool touches client data, and how to get the benefits without the exposure.
Your GDPR obligations do not change because it is AI
The first thing to be clear about is that UK GDPR and the Data Protection Act 2018 apply to AI just as they apply to everything else. Using an AI tool does not create a loophole, and it does not shift responsibility onto the software.
Your firm is almost always the data controller for your clients’ information, which means you remain accountable for how it is processed — including when an AI provider processes it on your behalf as a data processor. The ICO’s guidance on AI and data protection makes clear that the familiar principles still govern: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and security. AI is simply a new context in which to apply them.
The GDPR principles that matter most with AI
A few of those principles deserve particular attention when AI is involved.
Lawful basis and transparency. You still need a lawful basis to process client data, and clients should understand, through your privacy information, how their data is used — including that AI tools may be involved in producing their documents.
Data minimisation. Share only the data a task genuinely needs. Feeding a client’s entire file into a tool when a subset would do runs against the principle and widens your exposure.
Accuracy. AI can produce confident errors, and inaccurate personal data is a GDPR problem as well as a suitability one — which is one more reason a human must review and edit anything the tool generates.
Security. You must have appropriate technical and organisational measures to keep client data secure, which puts where and how a tool processes data at the centre of the decision.
Purpose limitation. Data collected to advise a client should not be quietly repurposed — for example, used to train an AI provider’s models. For client data, that is the answer you want to be a firm no.
Controller, processor and the DPIA
Two practical GDPR mechanics come up repeatedly with AI.
The first is the controller–processor relationship. When you use an AI provider, you are typically the controller and they are your processor, which means you need a written contract (a data processing agreement) governing how they handle the data, and you are expected to carry out due diligence on them.
The second is the data protection impact assessment. Under UK GDPR a DPIA is required for processing likely to result in a high risk to individuals, and the ICO expects one for many uses of AI on personal data. For a financial adviser introducing an AI tool that processes sensitive client information, a DPIA is often the right and expected step — documenting the processing, the risks and the safeguards.
The questions to ask before an AI tool touches client data
GDPR compliance becomes concrete at the point of choosing a tool. Before any client record goes near one, get clear answers — in writing — to a short list:
- Where is the data processed and stored? UK or EU-based processing keeps the arrangement simpler under UK GDPR.
- Is client data retained, and for how long? Storage limitation means data should not be kept longer than necessary.
- Is your data used to train the provider’s models? For client data, you want a clear no.
- Who can access it, including sub-processors, and how is access controlled?
- Is it encrypted in transit and at rest?
- Is there a data processing agreement, and have you done a DPIA where the processing is higher risk?
A provider who cannot answer these plainly is telling you something important.
Practical steps for advice firms
Beyond the tool itself, a few habits keep an AI-assisted firm on the right side of GDPR: never paste client data into free, general-purpose AI tools; set an AI usage policy and train staff on what may be entered where; update your privacy notice and records of processing to reflect AI use; keep a human reviewing output for accuracy; and involve your DPO or compliance function before rolling anything out. None of this is exotic — it is the data-protection discipline advice firms already apply, extended to a new category of tool.
Where Ammonite fits
Ammonite built Planbot so that firms can take on the efficiency without compromising on data protection. Client data is never stored and never used to train AI models, and the platform runs on UK-based Google Cloud, with the firm keeping control of its documents and the adviser or paraplanner reviewing and editing every report. Those answers map directly onto the GDPR questions above — data minimisation and control, storage limitation, security, and a firm no on model training — which is why data handling was a starting point in Planbot’s design rather than a later concern.
That perspective is first-hand: Ammonite was founded by Caroline Duff, a Chartered Financial Planner, and Rob Harradine, a Chartered Member of the CISI and former adviser, who understand both the efficiency an advice firm needs and the data obligations it carries.
You can see how Planbot works, read about the team behind it, or explore more in Ammonite’s Insights. For wider industry standards, PIMFA is a useful reference as firms set their own approach.
Frequently asked questions
Does GDPR apply when advisers use AI?
Yes. UK GDPR and the Data Protection Act 2018 apply to AI as to any other processing of personal data. Your firm remains the data controller and stays accountable, even when an AI provider processes the data on your behalf.
Can I put client data into tools like ChatGPT?
It is not advisable. Free, general-purpose tools may retain inputs or use them to train models, which for client data raises confidentiality and GDPR concerns. Use a purpose-built tool designed for the sensitivity of client information, with clear data terms.
Do I need a DPIA to use AI in my advice firm?
Often, yes. A DPIA is required for high-risk processing, and the ICO expects one for many uses of AI on personal data. Introducing a tool that processes sensitive client information is typically a case where a DPIA is the right step.
What makes Planbot different on data protection?
Planbot is designed not to store client data or use it to train AI models, and runs on UK-based Google Cloud, with the firm in control and a person reviewing and editing every report — answers that line up with the core GDPR questions firms should ask.
Give your paraplanning team more time for the work that needs their expertise. Ammonite’s Planbot combines AI for paraplanners with flexible Paraplanning software to streamline document preparation while maintaining your firm’s standards. Explore our Suitability report software and discover how AI-powered document generation can reduce repetitive tasks, improve consistency and support faster report production. Book a demo today.
