GDPR and legal AI: what firms should know

GDPR and legal AI is a pairing that receives less attention than it deserves in the legal technology discussion. Transactional documents routinely contain personal data: names of individual shareholders, directors' details, employee information in employment-related transactions, personal guarantors' data in finance matters. When those documents are processed by an AI tool, the UK GDPR framework applies to how that data is handled.

When does GDPR apply to AI tool use?

GDPR applies when personal data is processed by a controller or a processor. A law firm that uses an AI tool to draft or review documents containing personal data is a data controller. The AI tool provider, if they process that data on the firm's behalf, is a data processor. This means the relationship needs to be governed by a data processing agreement that meets the requirements of Article 28 of the UK GDPR: clear instructions, appropriate security measures, restrictions on sub-processing and a commitment not to use the data for the processor's own purposes.

A firm that is passing client documents containing personal data to an AI provider without a proper data processing agreement is not meeting its UK GDPR obligations, regardless of how beneficial the AI tool might otherwise be.

Data minimisation and purpose limitation

The GDPR principles of data minimisation and purpose limitation also apply. Data submitted to an AI tool should be limited to what is necessary for the drafting or review task. A tool that requires the firm to submit entire client files when only specific sections are relevant to the task is not designed with data minimisation in mind. Purpose limitation means the AI provider cannot use the data for purposes beyond those agreed: training a general model on client documents is not a permitted purpose unless the firm has specifically consented to this and can legally grant that consent.

What to ask before deploying

Before deploying any AI tool on live matters, firms should confirm that a data processing agreement is in place, that data residency is within the UK or an adequate jurisdiction, that data is not used for model training without specific consent, and that the tool's security measures meet the firm's standards. Scriptum is designed to meet all of these requirements. To review the specifics of our data processing terms and security architecture, book a demo and we can walk through the documentation.