What Directors Should Know About AI and Data Protection

Directors should require ICO-aligned data governance, run a policy-guided pilot of tools such as ChatGPT or Copilot with three to five heavy-typing users, measure six months of time savings, and secure contracts, access controls and logging before any wider rollout.

Buying Copilot or ChatGPT for everyone at once — run a small, governed pilot first

The common commercial mistake is buying licences before you prove the business case or the data controls. That wastes money and creates risk: uncontrolled prompts can leak customer data into third-party models, and blanket rollouts make containment hard. Start small — choose a team that types a lot and track measurable outputs.

Practically, the pilot should have clear success metrics (time saved, error reduction, number of repeat queries), documented prompt rules, and a fixed review cadence. Use a mix of technical and human controls: limit copy-and-paste of sensitive fields, route sensitive requests to internal search tools only, and require screenshots or logs for sample prompts. For businesses without the in-house resource to manage this, consider outsourcing the operational side to a managed provider; our managed IT and AIOps services can run pilots and help set policy.

In our experience, the clients most successful with AI tooling in the office started small and boring — a policy-guided ChatGPT or Copilot rollout to 3-5 heavy-typing users, six months of measurable time savings, then a considered expansion. The unsuccessful ones bought Copilot for everyone at once and got very little back.

Define a 6-month pilot window and report weekly for the first month, then monthly thereafter.
Assign an owner who signs off on prompt and data rules.
Keep a running log of example prompts and outputs for audit purposes.

Using AI without data governance — appoint a data owner and set binding rules

AI projects fail when responsibility is diffuse. Directors must appoint a named data owner (senior enough to get cooperation from IT, legal and HR) and publish binding rules that staff must follow. Assign accountability so failures are diagnosed and fixed quickly.

The rules should map to GDPR principles and ICO expectations: minimisation, purpose limitation, and access-control logging. The ICO offers practical guidance for organisations on handling personal data; reference that guidance when drafting policy and make it mandatory reading for pilot users (ICO’s guidance for organisations).

Key governance components:

Simple acceptable-use rules: what may never be pasted into an LLM (e.g., NHS numbers, payment card data).
Approved templates for prompts that strip or pseudonymise personal data.
Records of processing describing which AI tool does what, where data flows, and retention periods.

These elements form the basis of practical compliance and help demonstrate to regulators and auditors that the board took proportionate steps.

Assuming vendor promises remove your obligations — harden contracts and technical controls

Vendors will say they encrypt data or won’t use inputs to train models, but contractual language can be vague. Directors should ensure contracts include clear obligations, audit rights and incident notification timelines. Lock obligations into the contract rather than relying on sales assurances.

Ask for these clauses as standard:

Data processing agreement with defined roles (controller vs processor) and sub‑processor lists.
Explicit commitments on use of inputs for model training and the ability to opt out.
Encryption-at-rest and in-transit, plus key management responsibilities.
Notification within 24–72 hours of a data incident and defined remediation steps.

If a vendor resists audit or refuses to name sub-processors, treat that as a negotiating point or walk away. Directors should factor contractual risk into ROI calculations — an attractive price that leaves you exposed is not attractive.

Skipping monitoring and audit trails — instrument, measure and be ready to roll back

One failure mode is assuming that once policies are set, the job is done. Without logs, metrics and a rollback plan you won’t know if a policy is being respected or if a model has misbehaved. Instrument everything so you can answer what was asked, who asked it, and what output was used.

Actionable monitoring includes automated logging of prompts and outputs for the pilot group, regular sample reviews, and alerting on high-risk keywords. Keep a small archive of prompts and outputs for three to six months (consistent with your retention policy) so you can investigate complaints or regulatory queries.

When monitoring shows policy breaches or no productivity gain, be ready to suspend use or tighten rules. A defined rollback procedure (revoke access, remove local caches, rotate credentials) will limit exposure and reassure stakeholders.

FAQ

How long should a director-run AI pilot last before deciding to expand?

Run a pilot for about six months with three to five heavy-typing users to measure reliable time savings and surface governance issues before expansion.

Can a director be held personally liable if AI mishandles customer data in the UK?

Directors can face reputational and regulatory consequences if governance is demonstrably poor; document decisions, policies and audits to reduce personal and board-level exposure and get legal advice tailored to the incident.

What contract clauses should I insist on when buying an LLM-based tool?

Insist on a clear data-processing agreement, sub-processor disclosure, model-training opt-out, encryption commitments, and incident notification within 24–72 hours.

Do I need external help to set up AI data controls?

If you lack a senior data owner or SIEM/logging capability, using a managed provider to implement policy, monitoring and incident playbooks is a pragmatic option and speeds safe adoption.