Can I keep client details in AI memory under UK GDPR?
By Gary Dhanda · 11 November 2026 · 3 min read
Short answer
UK GDPR does not single out AI memory, so the normal rules apply. You need a reason to hold each piece of client personal data, you should hold no more than you need and you should not keep it longer than you need. For most small firms the practical answer is to keep client personal details out of AI memory.
What the law says
Article 5 of the UK GDPR sets out the principles. Two matter most here. Data minimisation: personal data should be adequate, relevant and limited to what is needed for the purpose. Storage limitation: personal data should be kept in a form that identifies people for no longer than the purpose needs.
An AI tool's memory is a store of data like any other. If it holds a client's name and circumstances, both principles apply to it.
What the ICO has said about generative AI
In a blog of 3 April 2023, the ICO's Stephen Almond set out questions for anyone using generative AI with personal data. They include settling a lawful basis, assessing the risks before you start and thinking about security. A memory feature does not change those questions. It makes them more pressing, because the data stays.
Why memory needs extra care
A chat ends. A memory carries on into later chats, where it may surface in work for a different client. It can also be saved without you choosing to save it. Anthropic's help centre says Claude saves memories on its own as you chat, unless you switch the setting off. Other tools have their own settings, so check each one.
That makes two things hard: knowing what is held and removing it when you should. Both are things the law expects you to be able to do.
A practical rule for a small firm
Keep how you work in memory: services, prices, templates, tone. Keep client personal details out. When a task needs client details, give them in that chat only, on a plan your firm has approved.
If you decide you do need client details in memory, write down why, who can see them, how long you will keep them and how you will delete them. Our six checks cover this.
Where this leaves you
The law asks you to hold less for less time and to know what you hold. On those terms a small firm can use AI memory with care.
This is a general guide, not legal advice. For your own position, speak to your data protection adviser. If you would like help setting the rules up, get in touch through our Contact page.
Sources
UK GDPR, Article 5(1)(c) and (e), legislation.gov.uk/eur/2016/679/article/5. Read 10 November 2026.
ICO, 'Generative AI: eight questions that developers and users need to ask', Stephen Almond, 3 April 2023, ico.org.uk. Read 3 November 2026.
Anthropic help centre, article 11817273 on Claude's memory, support.claude.com/en/articles/11817273. Read 10 November 2026.