Generally yes, if you set it up carefully. Sending payment reminders with software is lawful in the UK, and the main risks are practical ones: client data going into a public AI tool, a reminder that drifts into marketing, and an automated action that changes what a client owes without a person checking it. Choose a tool that keeps your data out of public AI models, and keep a person in front of anything with consequences.
In this article
The short version
- Sending payment reminders with software is lawful in the UK.
- Since February 2026, significant automated decisions are allowed with safeguards, including access to a human.
- Keep client data out of public AI tools; practices' professional guidance treats it as a likely confidentiality breach.
- A reminder that promotes your services becomes direct marketing, with consent rules for sole traders.
- Keep a person's approval on fees and account stops, and keep a record of what was sent.
What UK data protection law says about automated chasing
Chasing an unpaid invoice is a normal use of a client's details. You hold them to provide your service and get paid for it, and sending the reminder with software doesn't change that.
The rules on automated decisions changed in February 2026, when the Data (Use and Access) Act 2025 replaced the old Article 22 of the UK GDPR. Decisions with a legal or similarly significant effect on a person can now be made by software alone on most lawful grounds, as long as safeguards are in place. The person has to be told about the decision, be able to respond to it, be able to get a human to step in, and be able to challenge it. Much of what you'll read online still quotes the old, stricter version.
A payment reminder is unlikely to be a significant decision in that sense. The debt and the due date come from your contract, whether or not anyone sends a reminder. Escalation is less clear-cut. An automatic account stop, late fee or referral to a collection agency against a sole trader could count, and no regulator has yet said how these rules apply to invoice chasing. If software will take steps like those without a person approving them, take advice on your own set-up.
Data protection law covers people, not companies. When your client is a limited company, the rules apply to the contact's name and details, not to the company's debt. With sole traders and partnerships, you're dealing with individuals throughout.
Where your clients' data goes
For most businesses the bigger risk is the choice of tool. Copying client names, invoice details and payment history into a free, public AI chatbot to draft a reminder puts that data somewhere you don't control.
Accountancy and tax practices have specific guidance on this. The professional bodies' PCRT guidance on AI tools, issued in January 2026, says putting client data into publicly available AI tools is likely to breach client confidentiality unless the client has consented. Even outside the professions, it's sensible to treat client data the same way.
Before you let any tool email your clients, ask the vendor:
- Is my customers' data sent to public AI models, or used to train them?
- Where is the data stored, and who can access it?
- Do you have recognised security certification, such as ISO 27001?
- Will you sign a data processing agreement setting out what you do with it?
Adfin keeps your data away from public AI models and is ISO 27001 certified. Its Customer Agents send reminders from your own email domain, within rules you approve.
When a reminder becomes marketing
A neutral payment reminder is a service message, so the consent rules for marketing emails don't apply to it. The ICO's guidance is clear that this changes if the message promotes anything, even when promotion isn't its main purpose.
That matters with AI drafting. Ask a model to make a reminder warmer and it may add a friendly line about your other services. At that point the email counts as direct marketing. You can send marketing emails to companies, limited liability partnerships and Scottish partnerships without consent, as long as you identify yourself and offer an opt-out, but sole traders and other partnerships are treated as individuals, and emailing them marketing needs their consent or must fall within the exception for existing customers.
So keep promotional content out of your reminder templates, and check that the tool you use doesn't add any of its own.
What to keep a person in front of, and what to record
The safeguards in the 2026 rules make a sensible standard for any automated chasing, whether or not they strictly apply. Make sure a client can always reach a person, can explain their side and can get a decision looked at again.
In practice, let routine reminders on undisputed invoices run on their own, and keep a person's approval for anything that changes a client's position, such as a late fee, an account stop or a final notice. Hold back anything going to a client who's raised a dispute or told you they're in difficulty, and review the first messages after you change a template.
Keep a trail of each message: the date, the recipient, the trigger, and who approved anything out of the ordinary. You'll need it if a debt ever reaches a money claim, and it lets you answer a client who asks why they received a message. Data protection law says personal data shouldn't be kept longer than necessary, but doesn't set a period. Many businesses keep chasing records for as long as they could need them to pursue the debt, which for a contract debt in England and Wales is generally six years.
Common questions
Is it legal to use AI to send payment reminders in the UK? Generally, yes. Chasing an unpaid invoice is a normal use of client data, and since February 2026 UK law also allows significant automated decisions as long as safeguards are in place.
Can I put client data into ChatGPT or another public AI tool to write reminders? It's best not to. Accountancy and tax practices' professional guidance treats it as a likely breach of confidentiality without the client's consent, and any business loses control of the data.
Is a payment reminder classed as marketing? Not if it's neutral and about the invoice. If it promotes your services, it becomes direct marketing and consent rules can apply to sole traders and some partnerships.
Is an automatic account stop a significant decision under UK GDPR? It might be, especially against a sole trader, and no regulator has ruled on it for invoice chasing. Keep a person's approval in front of it, or take advice.
How long should I keep records of chasing emails? The law says no longer than necessary without fixing a period. Many businesses keep them for as long as they could pursue the debt.
What should I ask an AI credit control provider about data security? Whether your data goes to public AI models, where it's stored, what security certification they hold, and whether they'll sign a data processing agreement.
Sources
- legislation.gov.uk - UK GDPR, Article 22C: safeguards for automated decision-making (accurate as of October 2026) https://www.legislation.gov.uk/eur/2016/679/article/22C
- ICO - Direct marketing guidance: identifying direct marketing (accurate as of October 2026) https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/identify-direct-marketing/
- ICO - Electronic mail marketing (accurate as of October 2026) https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/
- ICAEW - Topical guidance: application of PCRT to ethical use of artificial intelligence tools (accurate as of October 2026) https://www.icaew.com/technical/tax/working-in-tax/pcrt/topical-guidance-application-of-pcrt-to-ethical-use-of-artificial-intelligence-tools
- legislation.gov.uk - Limitation Act 1980, section 5 (accurate as of October 2026) https://www.legislation.gov.uk/ukpga/1980/58/section/5
- Adfin - Credit control (accurate as of October 2026) https://www.adfin.com/credit-control
