If your CRM holds data about people in the UK or EU, UK GDPR applies to what you do with it, and that includes feeding it to an AI tool. This is a plain-English guide to the questions that come up. It is general information, not legal advice; check anything specific with your DPO or a qualified adviser.
The starting point
The contacts, leads, and account notes in your CRM are personal data. You already have obligations for how you process it: a lawful basis, fairness and transparency, data minimisation, and keeping it secure. Using AI on that data is still processing, so those obligations come with it.
What changes when AI is a cloud service
Sending personal data to a cloud AI provider adds a few considerations:
- A new processor. The AI provider processes your data on your behalf, so you need a data-processing agreement with them, and you should know their subprocessors.
- International transfers. If the provider processes data outside the UK (many are US-based), you need an appropriate transfer mechanism and to have considered the risks.
- Purpose and transparency. Using customer data with AI should be compatible with the purpose you collected it for, and with what you told people in your privacy notice.
- Training on your data. If the provider could use your data to improve its models, that is a further processing purpose you need to account for (and usually to switch off).
None of this makes cloud AI off-limits. It means there is a review to do before you switch it on.
Why on-device processing simplifies the picture
If the AI runs on your own machine and the personal data never leaves it, several of those questions fall away:
- There is no third-party AI processor for that step, because no one else receives the data.
- There is no international transfer of the data to an AI provider.
- There is no training-on-your-data question for the AI provider.
You still have your underlying GDPR obligations for holding the CRM data in the first place, on-device AI does not remove those. But it removes the extra layer that a cloud AI service adds. That is why, for sensitive customer data, local processing is often the simpler compliance story.
Upcells runs its AI on-device: the model processes your records on your machine as part of the Accelerator tier, so the AI step introduces no new data transfer. For the wider risk view, see is it safe to put CRM data into AI? and on-device vs cloud AI.
A short checklist
- Do you have a lawful basis for the processing the AI will do?
- Is it compatible with your original purpose and privacy notice?
- If cloud-based: is there a DPA, are subprocessors known, and are transfers covered?
- Could the provider train on your data, and have you turned that off?
- Could the task be done on-device instead, removing the transfer entirely?
Frequently asked questions
Does GDPR allow using AI with customer data? Yes, if you meet your usual obligations (lawful basis, transparency, security) and, for cloud AI, handle the processor, transfer, and training questions. On-device AI avoids adding a new processor or transfer.
Is on-device AI GDPR-compliant by default? It removes the extra processor and transfer questions that cloud AI adds, which simplifies compliance, but you still have obligations for holding and using the CRM data itself. It is a simpler story, not a blanket exemption.
Where can I get definitive advice? From your Data Protection Officer or a qualified adviser. This guide is general information only.