AI and data protection in UK architecture practices

Drawings, letters and minutes carry more personal data than most practices notice: the client’s name and address in every title block, the names behind every action in the minutes. Before those documents go to an AI provider, the law asks a few clear things of your practice. Here they are, with the sources.

Does data protection law apply to AI?

Yes. Whenever AI processes personal data, the UK GDPR and the Data Protection Act 2018 apply, as for any other processing. Both were amended by the Data (Use and Access) Act 2025; according to the ICO, all of its provisions affecting data protection law are now in force. The ICO’s guidance on AI and data protection explains how the law applies to AI. The ICO notes that the guidance is under review because of the 2025 Act.

A statutory code is on its way. Regulations in force since 12 May 2026 require the regulator to prepare a code of practice on personal data in the development and use of AI and in automated decision-making. On 8 October 2026 the ICO described the code as forthcoming, opened a call for evidence on agentic AI that runs until 20 November 2026, and left no doubt about agents:

Since 30 September 2026 the regulator is the Information Commission, a body led by a board, which took over from the Information Commissioner. It is still called the ICO.

Which data in project files is personal data?

Personal data is any information relating to an identified or identifiable natural person (UK GDPR, Article 4(1)). In a practice, that includes:

• the client’s name, address and telephone number on title blocks, letters and the contact list,
• the names behind the actions in meeting minutes and site visit reports,
• neighbours’ comments and emails in a planning file,
• photographs of an occupied home from the measured survey.

The law protects people, not organisations. If a developer, a housing association or a council is the client, information about the organisation itself is not personal data; the names and contact details of the people you deal with are.

Some data needs extra care. Data concerning health is a special category under Article 9(1) of the UK GDPR: processing it is prohibited unless one of the conditions in Article 9(2) applies. In a practice it turns up when a home is adapted for a disability or a client’s health shapes the brief. Keep it out of AI tasks unless the task needs it.

What does the UK GDPR require when your practice uses AI?

These provisions matter most in daily work with AI. The middle column summarises the law; the right-hand column is our reading for a practice.

Two more duties sit next to the UK GDPR. The ARB Architects Code 2025 expects architects to protect the confidentiality and security of the information they are responsible for (example 4.6). Contractors’ tenders and client documents are often confidential for commercial reasons too; for a public-sector client, ask before tenders go to an AI provider. And organisations that process personal information must pay the ICO a data protection fee unless they are exempt.

Which ChatGPT plan suits a practice?

The plan decides whether your content may be used to train the provider’s models. OpenAI says it does not use data from ChatGPT Business, Enterprise and Edu or from its API platform, inputs and outputs included, to train or improve its models by default. It offers a data processing addendum for ChatGPT Business, Enterprise and the API.

Individual plans work differently. With ChatGPT Plus or Pro, OpenAI may use your content for training unless you switch off ‘Improve the model for everyone’ under Settings, Data controls. The setting also applies to the work ArchX does through that account. Plus and Pro are individual plans: we do not recommend them for documents with clients’ personal data.

With an API key, your practice contracts directly with the provider under its business or API terms. According to the providers, OpenAI, Anthropic, Google (paid tier) and xAI do not use API data for training by default; with Mistral, you switch training off in your Mistral account. To detect abuse, OpenAI, Anthropic, Mistral and xAI keep API data for up to 30 days and Google for 55 days, longer if a breach of their terms is suspected.

Your provider may process data outside the UK, for example in the USA. Check that your agreement with the provider covers that transfer.

How does ArchX handle your project files?

ArchX runs on your computer. Here is what goes where, as the ArchX Privacy Notice for the United Kingdom sets it out:

For each task, ArchX sends the AI provider you chose what the work needs: your instruction, the conversation so far, attachments, the content of files the agent reads, tool results and images. With ‘Approve for me’, the agent’s requests for approval go there too, for the AI review. The connection runs directly from your computer to the provider: to OpenAI through your ChatGPT account, or with an API key to OpenAI, Anthropic, Google, Mistral (European location) or xAI. TYTOS sees neither the content nor your keys and is neither controller nor processor for this processing.

For the personal data of your clients, your practice is the controller under the UK GDPR, and your AI provider processes it under your contract with that provider. Your API key stays in the operating system’s key store, the Keychain on a Mac and the Credential Manager on Windows, and goes only to that provider.

For the licence, TYTOS receives your licence email address, a random installation ID, the operating system, the processor type and the version numbers. The interface between the app and the service does not accept project content, file names, paths or conversation text, and the service keeps no usage counts for UK practices. Project data reaches TYTOS only if you send it yourself, with ‘Report a problem’ or by email to support; TYTOS then processes it on your behalf under the Data Processing Terms. Every recipient is listed in the Privacy Notice.

Where should a practice start?

1. Choose the plan. ChatGPT Business or Enterprise, or an API key from your practice’s account. On Plus or Pro, every person switches off ‘Improve the model for everyone’.
2. Put the contract in place. Accept the provider’s data processing terms, and check where it processes data and which transfer mechanism it relies on.
3. Write one page. Which AI services are allowed, which documents may go in, who checks the results, and that meetings are recorded only when everyone present knows. Only 19% of UK practices have a written AI policy (RIBA AI Report 2026).
4. Tell people. Name your AI provider as a recipient in your practice’s privacy notice.
5. Check the results. A qualified person in your practice checks minutes, quantities and letters before they leave the office.

Then put the agent to work. ArchX uses the ChatGPT account or the API key your practice sets up, so it runs on the plan, the settings and the contract you chose.