Private & Secure AI
UK-hosted AI and GDPR: what businesses need to get right
The short answer
UK GDPR does not prohibit AI, but it does require you to identify a lawful basis, document the processing, control international transfers and be able to explain what happens to personal data. In practice that means hosting your data layer in the UK or EU, using model providers under a data processing agreement with zero retention and appropriate transfer safeguards, and completing a DPIA before launch. Getting this documented properly typically adds £2,000 to £8,000 to a project.
Indicative price ranges
Compliance groundwork
£2,000 – £8,000
DPIA, records of processing, DPA review, transfer assessment, retention policy and an internal AI use policy.
UK-hosted data layer
£1,200 – £6,000 / year
Application, database and document index hosted in UK or EU regions, with encryption at rest and in transit.
Full UK sovereignty
£25,000 – £60,000+
Open-weight models running on UK infrastructure so no personal data leaves the jurisdiction at all. Required only where contracts or regulators demand it.
Indicative UK ranges. We are a development partner, not a law firm — we build to the standard your DPO or legal adviser signs off, and we produce the technical documentation they need.
Typical timescales
- 1 week
Data mapping
What personal data exists, where it flows, and which of it the AI will touch.
- 1–2 weeks
DPIA
Necessary for most AI processing of personal data. Do it before the build, not after.
- 1–2 weeks
Architecture and contracts
Region selection, DPAs, transfer safeguards, retention settings.
- runs with the build
Implementation and evidence
Logging, deletion routines and the documentation pack for client audits.
Who this suits
- Any UK business processing personal data through an AI system — which includes most customer-facing assistants.
- Suppliers to the public sector, healthcare or financial services facing procurement scrutiny.
- Businesses with contractual data-residency clauses from their own clients.
- Organisations wanting to adopt AI without a compliance argument stopping the project at month three.
Who it does not suit
- Systems that touch no personal data at all — the burden is much lighter, do not over-engineer it.
- Businesses wanting a compliance certificate without changing anything technical. That is not how it works.
- Anyone hoping self-hosting removes the obligations. It changes the transfer question and nothing else.
What actually drives the cost
Special category data
Health, biometric or similar data raises the bar substantially and usually mandates a DPIA plus tighter controls.
Automated decision-making
If the AI decides rather than assists, Article 22 obligations apply and you need human review built in.
International transfers
Any processing outside the UK needs an assessment and appropriate safeguards, which takes documentation time.
Retention and deletion
Honouring erasure requests across prompts, logs and indexes needs engineering, not just a policy.
Six things to get right
1. Lawful basis. Decide it before you build. Legitimate interests covers most internal productivity use; customer-facing assistants handling enquiries usually rely on contract or legitimate interests. Write it down and be consistent.
2. Transparency. Your privacy notice must reflect that AI is used and what it does. If a customer is talking to an assistant, say so — clearly, at the start.
3. Data minimisation. Send the model the least it needs. Retrieval architectures help here by design: only the relevant passages go out, rather than the whole corpus.
4. International transfers. Most frontier models are processed outside the UK. That is permitted with the correct safeguards — an adequacy decision or the IDTA / EU SCCs plus a transfer risk assessment. Hosting your own data layer in a UK region reduces the scope of what transfers at all.
5. Retention. Set prompt and log retention deliberately and make sure erasure requests actually reach the AI system, including any vector index. Most organisations forget the index.
6. Human oversight. Where output affects someone materially, a human must be able to review and override. Build the escalation path, do not bolt it on.
What "UK-hosted" honestly means
It is a spectrum, and vendors are loose with the term. Be precise about which of these you are buying:
- UK-hosted data layer, overseas model inference. Your documents, database and index sit in a UK region; queries call a model processed abroad under a DPA with zero retention. This is the common, pragmatic setup.
- UK/EU inference regions. Some providers offer regional processing, which narrows the transfer question further.
- Fully self-hosted in the UK. Open-weight models on UK infrastructure. Nothing leaves. Highest cost, highest assurance, lower model quality.
Ask any supplier which of the three they are actually providing. The difference matters and is easy to obscure.
The documentation that wins tenders
A DPIA, a data flow diagram, a DPA with each processor, a retention schedule and an audit log policy. Increasingly your clients' procurement teams ask for exactly this pack, and having it ready is a commercial advantage as much as a legal one. We produce it as part of private AI delivery.
How we worked these numbers out
The price bands and timescales on this page are first-party figures taken from projects The Digital Hub has quoted and delivered for UK clients since 2020, not from third-party survey data. Ranges are rounded and exclude VAT. They are reviewed at least every six months and updated when our own delivered costs move. Where a figure depends on a third-party licence or hosting cost, that cost is named in the text so you can check it yourself.
Sources
- Guidance on AI and data protection — Information Commissioner's Office (ICO)
- International data transfer agreement and addendum — Information Commissioner's Office (ICO)
- Data, privacy, and security for Microsoft 365 Copilot — Microsoft Learn
- Enterprise privacy commitments — OpenAI
Written by
Tom Beachell
Technical Director, The Digital Hub
Tom leads scoping and delivery at The Digital Hub, quoting and shipping bespoke websites, CRM platforms and private AI systems for UK businesses. The price bands and timescales on this page come from projects he has personally scoped.
Published 01/08/2026 · Last reviewed 01/08/2026 · About The Digital Hub
Common questions
Do we need a DPIA for an AI system?
If it processes personal data at scale, uses new technology in a way that could affect individuals, or supports decisions about people, then yes — and AI deployments usually tick at least one box. It is a short exercise done early and an expensive one done late.
Is it legal to send UK personal data to a US AI provider?
Yes, with appropriate safeguards — an adequacy framework or the IDTA / SCCs, plus a transfer risk assessment and a data processing agreement. It is not automatically prohibited, but it must be documented.
Does UK hosting make us compliant?
No. Hosting location addresses the transfer question only. You still need a lawful basis, transparency, minimisation, retention control and oversight.
How do we handle a deletion request?
You need routines that remove the individual's data from the source system, the search index, stored prompts and the logs. Design this in — retrofitting deletion across a vector index is painful.
Next step
Get a fixed price for your own version of this
A 30-minute scoping call, then a written fixed price and delivery date. If an off-the-shelf tool is the cheaper answer for you, we will say so on the call.
- 1You tell us the process and the tools you pay for today.
- 2We map the scope and flag anything that will move the number.
- 3You get a fixed price, a schedule and an honest recommendation in writing.
Reply within one working day · No obligation · Full code ownership on every build