AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under UK GDPR anyone can ask a business for a copy of the personal data it holds about them, and the business normally has one calendar month to respond, free of charge. The deadline can be extended by up to two further months for complex or numerous requests, and the clock does not run while you reasonably confirm identity. An AI agent can log, search and draft, but a person should approve what is released and any redactions.
What a subject access request is
A subject access request, or SAR, is a person exercising their right of access under UK GDPR. It does not have to use those words, be in writing to a set address or mention the law. An email to a sales inbox saying "send me everything you have on me" counts. So does a message through a chat widget or a social media account the business runs. That is why small businesses miss them: the request arrives somewhere nobody thinks of as a legal channel.
The person is entitled to a copy of their personal data and supporting information, including why you process it, who you share it with, how long you keep it and where you got it.
The timetable
| Stage | General rule |
|---|---|
| Response due | Without undue delay and within one calendar month of receipt |
| Identity | You may ask for proof of identity if you have reasonable doubts; the clock starts once you have it |
| Clarification | If you hold a lot of data you may ask the person to specify what they want; the clock can pause while you wait |
| Extension | Up to two further months if the request is complex or the person has made several, telling them within the first month |
| Fee | Normally free; a reasonable fee only for manifestly unfounded or excessive requests or extra copies |
The ICO's guidance explains these rules, and the Data (Use and Access) Act 2025 put into law the position that a business need only make reasonable and proportionate searches. That does not permit a token search. It means the effort should match the request.
What an AI agent can do
Handling a SAR is mostly finding, collecting and recording, which suits an agent with access to your records.
- Recognise a request in any channel and open a case with the date received and the due date.
- Check whether identity is clear, and draft a polite request for proof only where there is reasonable doubt.
- Search the systems it can read, such as the CRM, invoices, support tickets and email, and list where the person's data appears.
- Assemble a draft response with the supporting information your privacy notice already contains.
- Flag third-party data, such as another customer's name in a complaint thread, for a person to redact or withhold.
- Remind the owner as the deadline approaches and record when the response was sent.
What a person must do
Several decisions in a SAR are legal judgements. Whether an exemption applies, such as legal privilege or information about another person, whether a request is manifestly unfounded, and what to redact should be decided by a person, with advice if the case is contentious. Requests made during a dispute with an employee or customer are often the ones that matter most, and they are where an agent should simply prepare the file and stop.
Worked example
Example only. A customer of a small online shop emails the support address after a delivery complaint: "I want a copy of all my data and your call recordings." The support agent recognises it as a SAR and passes it to compliance rather than answering it. The compliance agent opens a case on 3 March with a due date of 3 April. It finds the customer's order history, two support threads and one call recording, and notes that one thread names a courier driver. It drafts the response, marks the driver's name for redaction and sends the pack to the owner on 20 March. The owner approves the redaction and sends the pack on 21 March. The case log shows each step.
Preparing before the first request arrives
Most of the work in a SAR is knowing where personal data sits. A business that keeps a simple record of its systems, what personal data each holds and who can search it will respond faster and more completely than one that starts from nothing. The ICO's accountability guidance expects records of processing in many cases, and that record doubles as a search map.
- List each system that holds customer or staff data: CRM, accounts, email, support desk, payroll, shared drives.
- Note who can search each one, and whether the agent has read access.
- Agree a short template response that sets out the supporting information from your privacy notice.
- Decide who approves responses and redactions, and name a deputy for holidays.
- Train anyone who handles inbound messages to recognise a request, however it is worded.
With this in place, the one-month clock becomes a routine task rather than an emergency. It also makes it easier to spot a request that is part of a wider dispute and needs advice before anything is released.
Where Pryme fits
The Customer Support agent answers from your records and policy, so it can route a SAR to the right place instead of replying to it. The Compliance agent holds the deadline in its obligations register, and above its mandate a person decides. Every action is recorded with its source. If a request reveals a wider problem, read the first 72 hours of a UK data breach, and see audit trails for AI agents for what the record should show.
Questions people ask
Does a SAR have to be in writing?
No. A request can be made verbally or in writing, through any channel, and does not need to mention the law. It is good practice to confirm a verbal request in writing.
Can I charge for a subject access request?
Normally no. A reasonable fee may be charged only if a request is manifestly unfounded or excessive, or for further copies.
Can an AI agent send the response itself?
It can draft and assemble it, but a person should approve what is released, especially redactions and exemptions, because those are legal judgements.
What if I cannot find all the data within a month?
If the request is complex you can extend by up to two further months, but you must tell the person within the first month and explain why.
Sources
- ICO: UK GDPR guidance and resources · accessed Oct 2026
- GOV.UK: Data (Use and Access) Act 2025, data protection and privacy changes · accessed Oct 2026
- ICO: Accountability and governance · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.