GDPR Conflicts with AI/LLM projects and how Claris FileMaker can help
The UK’s data protection laws remain broadly aligned with EU GDPR standards following Brexit but have begun to diverge incrementally in 2025 due to recent legislative changes, notably the Data (Use and Access) Act 2025 (DUAA). Artificial Intelligence (AI) and Large Language Models (LLMs) like ChatGPT, Gemini, and Anthropic Claude are rapidly becoming everyday business tools. From drafting emails to analysing customer data, many UK SMEs are exploring AI to improve productivity and insight.
But there’s a problem: AI and GDPR don’t always play nicely together.
Even well-meaning businesses can easily cross compliance lines without realising it — especially when sensitive data finds its way into third-party AI tools.
At DataTherapy, we’ve seen this tension first-hand. As a Claris Platinum Partner with extensive experience in secure FileMaker development and hosting, we help organisations harness AI securely - keeping innovation aligned with GDPR principles.
Here are 10 often-overlooked areas where AI and GDPR can conflict, and how Claris FileMaker can help you stay compliant:
1. Lawful Basis of Processing & Transparency
The Challenge:
Staff may paste personal or client data into AI tools without considering lawful basis or consent.
Why It Matters:
GDPR requires data to be processed only for specific, transparent purposes.
How FileMaker Helps:
FileMaker provides a controlled environment where all data access is logged and purpose-specific. With Claris Connect or other scripted integrations, every AI request can be recorded and monitored, ensuring clear audit trails and demonstrable transparency.
2. International Data Transfers
The Challenge:
Many AI providers host models outside the UK/EU, risking non-compliant data transfers.
Why It Matters:
GDPR restricts international transfers of personal data without safeguards such as SCCs or adequacy decisions.
How FileMaker Helps:
With UK-based FileMaker Server hosting from DataTherapy, your data never leaves UK jurisdiction. AI integrations can be deployed locally or within secure, compliant environments, or anonymised - keeping your data residency under full control.
3. Automated Decision-Making & Profiling
The Challenge:
AI tools can automate customer triage, hiring filters, or credit scoring without human oversight.
Why It Matters:
GDPR Article 22 restricts “solely automated” decisions that affect individuals.
How FileMaker Helps:
By design, FileMaker supports human-in-the-loop workflows. AI-generated insights can be reviewed and approved within FileMaker dashboards, maintaining accountability and avoiding automation bias.
4. Data Minimisation & Purpose Creep
The Challenge:
LLMs often work best with more data, but that can lead to oversharing or reusing data beyond its intended purpose.
Why It Matters:
GDPR demands that only the minimum necessary data be used.
How FileMaker Helps:
FileMaker layouts and scripts can restrict data views, anonymise exports, or apply filters before any information is shared with an AI. That means better data discipline — and fewer compliance headaches.
5. Accuracy Obligations
The Challenge:
AI tools occasionally “hallucinate” or generate incorrect personal information.
Why It Matters:
GDPR requires personal data to be accurate and up to date.
How FileMaker Helps:
FileMaker allows teams to verify AI outputs before saving them back into production data. Paired with validation rules and audit logging, you can ensure all AI-sourced information remains correct and traceable. Built-in FileMaker Semantic Search script steps are a 'low temperature', highly structured usage of AI/LLM services and so are less generate hallucinations than less structured, manual ad hoc prompting.
6. Right to Erasure vs. Model Retention
The Challenge:
Once customer data is used to train or fine-tune an LLM, it can’t easily be deleted.
Why It Matters:
GDPR gives individuals the “right to be forgotten.”
How FileMaker Helps:
Rather than embedding data in AI models, FileMaker can feed AI temporary, contextual data on demand via a structured API request. All personal records remain fully erasable within your database, ensuring GDPR rights remain intact.
7. Employee Monitoring Risks
The Challenge:
AI analytics can unintentionally cross into employee surveillance.
Why It Matters:
GDPR and UK employment law restrict covert or disproportionate monitoring.
How FileMaker Helps:
FileMaker dashboards can present transparent, aggregated views of operational data — allowing fair performance tracking without breaching privacy. You can even include employee consent acknowledgements directly in the system.
8. Shadow AI Use (Bring Your Own AI)
The Challenge:
Employees often use unapproved AI tools that may expose customer data externally.
Why It Matters:
The business remains the data controller — and liable for misuse.
How FileMaker Helps:
By centralising all approved AI access through FileMaker, you can log every interaction with external AI services and enforce authentication. This stops unauthorised “shadow AI” activity and keeps data governance consistent.
9. Explainability & Accountability
The Challenge:
LLMs are black boxes, making it difficult to explain how they reached their conclusions.
Why It Matters:
Individuals have the right to understand decisions made about them.
How FileMaker Helps:
FileMaker can log every AI prompt and response, giving you complete traceability for decision-making. Combine this with a human review process to ensure explanations are always available when needed.
10. Special Category Data Risks
The Challenge:
AI models can infer sensitive personal traits even if not explicitly provided.
Why It Matters:
Processing special category data requires explicit consent.
How FileMaker Helps:
FileMaker enables field-level data classification and consent tracking. You can tag special category data fields, apply warnings, and ensure they’re excluded from AI interactions automatically.
In Summary
AI has enormous potential for UK businesses — but innovation must be balanced with compliance.
Claris FileMaker gives SMEs the data control, transparency, and flexibility needed to experiment safely with AI.
By integrating FileMaker with modern AI tools and hosting your solutions securely with DataTherapy’s UK infrastructure, your organisation can:
✅ Innovate confidently
✅ Maintain full GDPR compliance
✅ Protect both customer trust and operational integrity
About DataTherapy
DataTherapy is a UK-based Claris Platinum Partner specialising in custom FileMaker development, cloud hosting, and integration with APIs and emerging technologies like AI and LLMs.
We help organisations harness the power of intelligent automation—securely, efficiently, and always within GDPR boundaries.
Ready to explore AI safely with FileMaker?
Contact the DataTherapy team to discuss a compliance-aware AI integration strategy for your business.
