AI Tools Data Privacy Policy Checklist

Where to Find the Privacy Policy

Look for links in:

• The website footer (often labelled “Privacy” or “Legal”)
• Tool documentation or help centres
• Sign-up screens or account settings

Search terms to try:

• “[Tool name] privacy policy”
• “[Tool name] GDPR compliance”
• “[Tool name] data use”
• “[Tool name] data retention”

---

Key Questions to Ask

Question	Why it Matters	Look For Terms Like...
Is my data stored?	Data might be logged or retained after use.	"retention", "log", "store", "data use"
Is it used to train models?	Content may be reused to improve the tool.	"training", "model improvement"
Can I opt out of data use?	Some tools allow stricter privacy controls.	"opt-out", "privacy settings", "control"
Is data processed outside the UK?	Data may be subject to different legal protections.	"international transfers", "SCC", "US"
Is there a Data Processing Agreement (DPA)?	Essential for business compliance with UK GDPR.	"DPA", "data processor", "enterprise"

---

Before Using an AI Tool with Personal or Customer Data

Tick off each of these:

• I know where the data is processed
• I’ve checked the default settings (e.g. logging or training options)
• I’ve confirmed data won’t be used for training without consent
• I have (or have requested) a DPA or written terms
• I’ve reviewed this with our legal, IT, or data protection lead

---

Red Flags to Watch Out For

• Vague terms like “data may be used to improve our services”
• No option to disable training or data storage
• No mention of GDPR or UK compliance
• No available DPA (or only for paid plans)

---

Disclaimer

This checklist is for general informational purposes only and does not constitute legal advice. Always consult your organisation’s data protection officer or legal team before sharing personal or customer data with external AI tools.