Data Protection Consultant for UK Businesses Using AI
Your data protection obligations did not change when your business started using AI. The amount of personal data moving through tools you do not fully control did.
We are data protection consultants who work where privacy and AI meet. We make sure your compliance reflects how your business actually runs today, not how it ran when the paperwork was written.
Advising business owners and leaders across the UK, Australia, New Zealand, Canada, Sweden and the Philippines. Members of the IAPP.
Why Data Protection Looks Different Once AI is in the Business
Most UK businesses did their GDPR work in 2018. They wrote a privacy policy, built a record of processing, signed data processing agreements and trained their staff. For many, that work has not been properly revisited since.
In the meantime, the way personal data moves through the business has changed. Staff paste customer emails into ChatGPT. Your CRM summarises client records using a model you have never reviewed. A supplier added AI features to a platform you signed up to years ago without updating the contract to mention them.
None of this removes your obligations under UK GDPR and the Data Protection Act 2018. It adds to them. The ICO's guidance on AI and data protection expects most uses of AI involving personal data to be assessed before they go live. The Data (Use and Access) Act 2025 is also changing parts of the UK framework as its provisions come into force.
A data protection consultant who understands AI closes the gap between what your documents say and what is actually happening to your data.
When Businesses Bring in a Data Protection Consultant
Your compliance was built before AI
The policies and records exist. They describe a business that no longer exists. We bring them up to date with how your teams and tools actually handle personal data.
You are deploying AI on personal data
Customer service, HR, marketing, analytics. Each use needs assessing before it goes live. The decisions you make now on vendors, contracts and data flows are hard to undo later.
Someone is asking hard questions
A data subject request you cannot answer. A procurement questionnaire from an enterprise customer. A breach, a complaint or a letter from the ICO. We help you work out your position, what to say and what to do next.
What a Data Protection Consultant Does For Your Business
A data protection consultant helps you meet your obligations under UK GDPR, and the EU GDPR where it applies, in a way that fits how your business operates. At Hyplon, that work covers:
→ UK GDPR gap assessments, showing where you are compliant, where you are exposed and what to fix first
→ Records of processing that show what personal data you hold, why, where it goes and how long you keep it, including data going into AI tools
→ Data protection impact assessments for high risk processing, including new AI tools and AI features added to software you already use
→ Privacy notices and policies that tell customers and staff, in plain language, how their data is used and where AI is involved
→ Supplier contracts and DPAs, including whether a supplier can use your data to train its models
→ International transfers, so you know which tools send personal data outside the UK and which safeguards apply
→ Processes for data subject requests and breaches that your team can actually follow
→ Practical, role-specific training so staff know what they can and cannot put into AI tools
Data Protection and AI Governance Work Together
Data protection is one part of AI governance. AI is now one of the biggest sources of data protection risk. We treat them as one conversation, so you are not paying two advisors to look at the same tools from different angles. If you need the wider picture, see our AI governance service .
The Data Protection Gaps We See Most Often
AI tools nobody assessed. Staff using personal accounts or free tools for work, with client data going in and no record of it.
Privacy notices that are silent on AI. Telling people their data is used for "service improvement" when it is being processed by a third-party model.
AI you did not choose. Features switched on in software you already pay for, processing personal data in ways your assessments and contracts never covered.
Records that are out of date. A record of processing built years ago that does not list half the systems now in use.
Training data clauses. Supplier terms that allow your customer data to be used to train or improve someone else's model.
Retention that never happens. Data kept indefinitely because nobody owns deletion, including the prompts and outputs stored by AI tools.
These are the most common. Yours may go further.
Not sure where your gaps are?
A 20 minute conversation will tell you.
How to Work With Our Data Protection Consultants
Four ways in, depending on where you are.
AI Governance & Privacy Review
A focused engagement to work out where you stand on data protection and AI. What you have, what you are missing and what to do next. Not a checklist, but a strategy you can execute.
Fractional Chief AI Officer / Data Protection Officer
When you need a DPO, or a senior person to own data protection at leadership level, we take on the role. The DPO must be able to act independently, which is one reason many organisations appoint externally.
AI Governance & Privacy Advisory
Ongoing data protection and privacy support as your business and its use of AI change. New tools, supplier reviews, risk decisions and board reporting, handled by people who already know your business.
Document & Policy Review
Privacy policies, DPAs, terms of service and internal policies, reviewed against how your business really operates rather than against a template.
Recent Data Protection Work
A global travel company was already using AI chatbots across its customer service operation. We completed privacy impact assessments on its AI tools, aligned its privacy policy with upcoming regulatory deadlines and rolled out AI-specific staff training. The business now has a clear view of where AI touches customer data, which risks need attention and which controls are required.
A UK-based chatbot provider needed contracts that reflected how its AI service actually worked. We drafted its Data Processing Agreement and revised its Terms of Service to include how customer data can and cannot be used to train AI models. The review also found that the AI model in use had been configured in a way that did not match the Terms of Service. The owner was able to align the product with the paperwork before it became a bigger problem.
We are Marnie McLeod and Roger McCluskey, data protection and governance advisors specialising in AI.
Between us, we have run businesses, sat on boards, worked inside regulatory investigations and built information security and privacy programmes for global organisations. We come from business, not from IT. That is the difference.
You work with the principals. We lead the work ourselves, and you speak directly to the person with the answer.
Why Work With Hyplon
Frequently Asked Questions About Data Protection Consultants
-
A data protection consultant helps your business handle personal data lawfully and safely. That includes gap assessments, records of processing, DPIAs, privacy notices, supplier contracts, breach processes and staff training. At Hyplon, we also cover how AI tools use the personal data your business holds.
-
Under UK GDPR, you must appoint a DPO if you are a public authority, or if your core activities involve large-scale, regular and systematic monitoring of individuals or large-scale processing of special category or criminal offence data. Many businesses that are not required to appoint one still choose to have a named person who owns data protection. We can act as your DPO or support the person who holds the role.
-
A consultant advises and delivers specific work. A DPO is a formal ongoing role with defined tasks under UK GDPR, reports to the highest level of management and must be able to act independently. The same advisor can do both, and we often do.
-
Largely, yes. "Data protection" is the term used in UK law. "Privacy" is more common in the US and Australia. We work with clients in all three, so we use whichever term fits the law that applies to you.
-
Often, yes. A DPIA is required for processing that is likely to result in high risk to individuals, and the ICO considers most uses of AI involving personal data likely to meet that bar. Read our guide on when the law expects a DPIA.
-
Your legal team knows the law. We know how that law applies to the tools and data flows inside your business, especially AI. We work alongside legal, IT and risk, not instead of them.
-
Every engagement is scoped to your business. After our first conversation, we send you a no-obligation scope of work so you know what is involved before anything starts.
Get a Clear Picture of Your Data Protection Position
Send us a message or book a free 20 minute conversation with Marnie or Roger. You will leave with a clear read on where your data protection is exposed, what is working and where to start. No pitch. No obligation.