Before you map AI content operations data protection duties

What to take away

Why the sign-off habit fails

Content operations run continuously, so compliance cannot be a one-off review. Every new prompt or shared folder creates another copy of whatever data you pasted in.

Government publishers treat maintenance as part of the job. The GOV.UK guidance on managing existing content sets out owners, review points and archiving, a discipline that matters when a page or its drafts hold personal data.

Under the UK GDPR and the Data Protection Act 2018, every use of audience data needs a lawful basis from the Article 6 list — consent, contract, legal obligation, vital interests, public task or legitimate interests — and an entry in your record of processing activities under Article 30. You must know what personal data you hold and how long you keep it. The same duties reach teams in England, Scotland, Wales and Northern Ireland, and they follow the workflow, not the publishing date.

Map the data before you generate anything

Pseudonymisation reduces risk while keeping records useful. The EDPB guidelines on pseudonymisation explain the technique for audience and CRM sets, which is where most content teams meet it.

Then decide where each duty sits in your process: who keeps the Article 30 record, who screens for a DPIA and who answers requests. The UK rules and compliance guide gathers the same duties in one place if you are choosing tools next.

What to document before a tool touches audience data

Check the processor terms for training rights. Article 28 requires a written contract with every processor, covering what the vendor may do with your data, its security duties, its use of sub-processors and the deletion or return of data when the contract ends. If a vendor may train on your inputs, that shapes what you can paste in and belongs in the record.

Screening matters too. Article 35 requires a data protection impact assessment before processing likely to result in a high risk to individuals — large-scale profiling, systematic monitoring, special category data and new technology are the usual triggers, and the ICO publishes a list of the operations that always need one. A tool that scores or profiles people carries different risk from one that tidies a paragraph, so document the screening decision either way.

International transfers: Chapter V, the IDTA and adequacy

Sending audience data to a tool hosted outside the UK is a restricted transfer under Chapter V of the UK GDPR. Check first whether the destination has UK adequacy regulations. If it does not, the usual routes are the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, backed by a transfer risk assessment.

Retention periods for prompt logs and drafts

Set a default retention period and apply it. Common choices are 30, 90 or 365 days, and the right one depends on the data type, the lawful basis and the reason you kept it.

Drafts, exports and test files are the usual overspill. If nobody owns deletion, prompt logs quietly become the longest-held copy of your audience data.

Handling access and deletion requests across tool accounts

One request can touch five systems. Under Article 12 you have one month to answer — a subject access request under Article 15 or an erasure request under Article 17 — and the clock does not stop because the data sits in a tool account. Keep a list of accounts, admins and export routes so you can search them without guessing.

Test the route once with a dummy record. A deletion path you have never run is not a deletion path.

Breaches run to a different clock. Under Article 33 you must tell the ICO within 72 hours of becoming aware of a personal data breach, and under Article 34 you must tell the people affected without undue delay where the risk to them is high. Personal data sitting in prompt logs or draft files falls under the same duty.

Worked example: a five-person content team in England

Say a team in Sheffield pays £260 a month for a content platform and £90 a month for an AI writing add-on. That is £4,200 a year on tooling.

Add a one-off records review at £1,100, an annual refresher at £600, and six hours a month of editorial time at £35 an hour, which is £2,520 a year. The total lands near £8,420.

Those figures are illustrative, and the shape matters more than the totals.

Processor terms carry their own cost. AI content operations commercial contracts sets out clauses worth negotiating before renewal, including training rights and deletion duties.

Where the AI rulebook is still moving

Regulation is moving in several jurisdictions at once, and teams often inherit the strictest rule their client faces. The EU AI Act is phasing in across Europe, while the UK has kept its sector-led approach, which leaves the UK GDPR as the binding text for content teams.

The NIST record of AI congressional mandates and executive orders tracks United States federal activity, which matters if you publish for a US parent or client.

In the UK, the ICO remains the regulator to watch. Its guidance on AI and data protection and its AI and data protection risk toolkit are the two documents to check first, and they change more often than the Act.

This is general guidance. Individual cases need a qualified adviser.

Common questions

Does UK GDPR apply to AI-generated drafts?

Yes, where a draft contains personal data about a living person. Who wrote it changes nothing about your duties.

Do we need a DPIA for an AI writing tool?

Not always. A DPIA is likely when processing is large scale, systematic or involves profiling, which is the test in Article 35. Record the screening decision either way.

How long can we keep prompt logs?

There is no single legal limit. Keep them only as long as you can justify, then delete, and write that period down.