Is it GDPR-safe to use AI on client bank statements?
Published 11 October 2026 · ClearStatement
The short answer
It can be, if you treat the AI tool like any other supplier that handles client data. You stay the controller, so you need a lawful basis and a privacy notice that covers it; the tool's provider needs a written processor contract (a DPA); you should know exactly what data is sent and where it goes; and you should consider whether a data protection impact assessment (DPIA) is needed.
This guide is general information for UK firms, not legal advice. Your own data protection officer or compliance team should make the final call for your firm.
1. You are the controller
When you process a client's bank statement, your firm decides why and how that data is used, so your firm is the controller. A software provider that processes the data on your behalf is a processor. The responsibility for having a lawful basis, and for telling clients how their data is used, stays with you. The ICO explains the responsibilities of controllers using a processor.
2. Get a written processor contract
UK GDPR Article 28 requires a written contract between a controller and a processor, setting out what the processor may do with the data, security, confidentiality, use of sub-processors and what happens at the end. If an AI tool can't show you one, that is a reason to stop. See the ICO's guidance on what needs to be in the contract.
3. Know exactly what is sent, and to whom
Ask the provider to show you, field by field, what leaves your computer. A tool that uploads the whole statement file sends far more than one that sends only the lines it needs. Ask too which sub-processors receive the data (for example, the AI model provider), whether any of them keep it, and whether it is used to train models.
4. Check international transfers
Many AI models are run by providers outside the UK. Transfers outside the UK need a recognised safeguard, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. The ICO explains the IDTA and the Addendum.
5. Consider a DPIA
A DPIA is required where processing is likely to result in high risk. The ICO's list of processing that can need one includes the novel application of existing technologies, including AI, when combined with other risk factors. Bank statements can also reveal sensitive details, such as payments to a health provider or a place of worship. Even where a DPIA isn't strictly required, a short written screening is good evidence of thought. See when you need a DPIA.
6. Update your client privacy notice
Clients have the right to be informed about how their data is used, including the types of organisation it is shared with. A sentence covering software used to prepare their case, including AI categorisation, is usually enough.
Questions to ask any AI tool
- Will you sign, or have you published, a data processing agreement?
- Is the statement file uploaded, or only extracted lines? Which fields exactly?
- Who are your sub-processors, and where do they process and store data?
- Do you, or your AI provider, keep the data? For how long? Is it used for training?
- What safeguard covers transfers outside the UK?
- How quickly will you tell us about a personal data breach?
How ClearStatement answers those questions
| Processor contract | Our Data Processing Agreement is published and forms part of our Terms. It can also be signed as a standalone agreement. |
|---|---|
| What is sent | Statement files are read in your browser and never uploaded. Transactions your category template matches are never sent. Only if you choose AI categorisation for the lines it didn't match, and only after you confirm, the description, amount and direction (in or out) of those lines are sent. Account holder names, account numbers, sort codes, balances and dates are not sent. |
| Where it goes | Over HTTPS to our own relay on Cloudflare, which forwards it to Anthropic's Claude API and returns a category. The relay does not log, cache or store it. |
| Retention and training | We store no client data. Under its commercial terms, Anthropic does not use the data to train its models by default and deletes API inputs and outputs within 30 days, except where it must keep them to enforce its usage policy or comply with law. |
| Transfers | Anthropic stores data in the US and may process it in the US, Europe, Asia or Australia, under its Data Processing Addendum with Standard Contractual Clauses. US-only processing is available on request. |
| Breaches | We will notify you within 48 hours of becoming aware of a personal data breach affecting client data. |
| Saved cases | If you save a case, it is encrypted in your browser and saved only to your own device. We never receive a copy. |
One thing to be aware of: a transaction description recorded by a bank can itself contain a payee's name or a payment reference, and that text is part of what is sent when you use AI categorisation. You can avoid sending a line at all by adding a keyword that matches it to your template, or by categorising it yourself.
Full details are in our Privacy Policy and Data Processing Agreement. For a security questionnaire or a client privacy notice wording, email help@clearstatement.co.uk.
More guides
ClearStatement is a productivity tool for mortgage professionals. This guide is general information, not financial or legal advice; always follow the lender's own criteria.