AI and client data: what UK and Canadian financial firms should ask

UK GDPR does not mention AI, but it governs it wherever personal data is involved, and deal documents are full of personal data: directors, shareholders, employees, counterparties. A firm needs a lawful basis for each use, and processing that is novel or large-scale, which describes most AI adoption, is exactly the territory where a data protection impact assessment is expected. The ICO has published AI-specific guidance, and it leans hard on two ideas: know what your systems are doing with personal data, and be able to explain it.

The practical questions that follow are about processors. Every vendor whose infrastructure touches the data is part of the chain the firm is accountable for. Each new AI tool with its own cloud, its own subprocessors and its own jurisdictions extends that chain. Shortening it is the simplest compliance work a firm can do.

Federally, PIPEDA sets the baseline for commercial handling of personal information: meaningful consent, accountability for what service providers do with data you hand them, and safeguards proportionate to sensitivity. Financial information sits at the sensitive end by any reading. A firm remains answerable for its vendors' handling of client information, which makes the AI supply chain a compliance object in its own right. Both regimes treat that chain as the firm's responsibility rather than the supplier's.

Quebec's Law 25 goes further, and any firm with Quebec clients or operations should treat it as the binding constraint. It expects a named privacy officer, privacy assessments before personal information is communicated outside Quebec, and transparency when decisions about individuals are automated. For an AI workflow, that turns two casual defaults, offshore processing and unexamined automation, into things that must be assessed and documented before they happen.

Privacy statutes protect personal information, but most of what moves through a deal is confidential rather than personal: financials, strategy, the fact that a company is for sale at all. That material is protected by NDAs and engagement letters, and those obligations are often stricter than statute, with no exemptions for processing that a privacy regulator might tolerate.

This is why running client material through a consumer AI tool is a problem even when no personal data is involved. The question is not only whether a regulator would object, but whether the firm could look a client in the eye and describe where its information went. If the answer involves a service the firm cannot name the storage location of, the answer is no. This is also why the test is easier than it sounds. A firm does not need to interpret a statute to apply it; it needs to be able to say where the information went.

Architecture is part of the privacy assessment, alongside contractual terms and operating practices. Map the actual flow of client information: storage, model processing, providers, access and retention. Whether the system uses managed infrastructure or the firm's own environment, the choices should be documented and appropriate to the work.

The same design keeps the processor chain short enough to describe in one sentence, which is roughly the standard a client's lawyers apply. Firms are often surprised that the compliant architecture is also the convenient one. It is not a coincidence: both problems are about knowing where data is. Choosing the model then becomes an ordinary engineering decision, revisited as the market moves, rather than a commitment the firm has to live with.

Five questions expose most of what matters. In which jurisdictions is our data stored and processed, and can we choose? Is any of it used to train or improve any model, and where is that excluded in writing? Who are the subprocessors, and what happens when the list changes? Can you support an impact assessment with real technical answers rather than marketing? And when we leave, what is deleted, when, and how is that evidenced?

A supplier serving financial firms in the UK and Canada should answer all five without hesitation, because it will have been asked them before. Hesitation is information.

An assessment is only as good as the technical answers behind it. For an AI workflow, the firm needs to be able to state what personal data the system reads, where it is processed and stored, which subprocessors are involved, whether any of it is retained or used to improve a model, and how access is controlled and revoked. A supplier who can answer those in writing makes the assessment a short document.

A client-controlled tenant can make some storage and identity boundaries clearer, but the assessment still needs to cover every service that processes information. Model calls, connectors and support access may involve other providers. Document the actual arrangement rather than inferring that information cannot leave the tenant.

Two things. The processor chain has to be explainable under both regimes at once, which argues for keeping it short, and the choice of where data is stored and processed has to be deliberate rather than a vendor default. A firm in London with a Quebec client, or in Montreal with a UK counterparty, needs to be able to say in which jurisdiction a given document sat while a model read it.

A Microsoft tenant has data-location settings, but a connected workflow can involve processing outside it. Check the locations and terms of each hosting, integration and model provider. Where a client has particular requirements, agree and document the arrangement before processing their material.

The end of an engagement is where privacy commitments get tested, so it should be designed at the start. When Verdalyze leaves a firm, the sequence is:

• Our access to the firm's data is revoked by the firm; the systems keep working.
• Documentation and everything we hold are handed over in standard formats.
• Anything Verdalyze holds is deleted within 90 days.
• Nothing was ever pooled with other firms, so there is nothing else to unwind.

A firm asking any supplier about offboarding should expect an answer of that shape: a sequence, a timescale and a statement of what the supplier never held in the first place.

Our approach, building AI systems for deal firms from London and Montreal, is to handle client information securely and privately and agree the architecture with the firm. Hosting may be managed or within a client-controlled environment. Processing, providers, access, retention and handover need to be explicit in either case.

None of that is exotic engineering; it is a set of defaults chosen once, at the start, when changing them costs nothing. Firms that ask these questions before adopting AI get the same result cheaply. Firms that ask them afterwards fund a migration.