hiddentokens.com/uk-gdpr-ai · 27 October 2026 · info@hiddentokens.com
Hidden Tokens in the United Kingdom: AI, the UK GDPR and professional confidentiality
Your teams use Copilot, ChatGPT or Claude on client files, whether you are a firm of solicitors, an accountancy practice or an SME. Hidden Tokens codes names, companies and identifiers on your computer, before the AI reads the file, and puts the real values back into the result, on your side.
Download this sheet (PDF) A4- The UK GDPR and the Data Protection Act 2018 require security of processing and data protection by design; paragraph 6.3 of the SRA Code of Conduct and the ICAEW Code of Ethics require client confidentiality.
- Hidden Tokens codes names, companies and identifiers on your computer before the AI reads the file; the key stays with you and is never transmitted. With the folder set to English, the codes are in English:
NAME-001,COMPANY-002. - Not covered yet: the sort code and account number, UK mobile numbers and part of the National Insurance number. Until the UK identifiers pack ships, we offer UK organisations the pilot only, and we add these formats to your policy as pattern rules.
- From £26 a month (Solo, billed £312 a year), excl. VAT. 14-day trial, no account, no card.
Why the question arises
- The UK GDPR and the Data Protection Act 2018 require security of processing and data protection by design; the ICO has published guidance on AI and data protection.
- AI providers are mostly American. Transfers to the United States rely on the UK-US data bridge (in force since 12 October 2023) or other safeguards; a coded file reduces what leaves.
- Professional confidentiality: paragraph 6.3 of the SRA Code of Conduct requires solicitors to keep their clients' affairs confidential; the ICAEW Code of Ethics sets the same principle for accountants; the common law duty of confidentiality and the Caldicott Principles apply in health and care.
What the texts say, and what Hidden Tokens does
| Text | What it requires | What Hidden Tokens does |
|---|---|---|
| UK GDPR, arts. 4(5), 25 and 32 | Pseudonymisation, data protection by default, security | Coding by default on the computer; key kept separately, never transmitted |
| UK GDPR, art. 35 | A data protection impact assessment (DPIA) for high-risk processing | DPIA template provided (in French for now) |
| UK GDPR, chapter V | Safeguards for transfers outside the UK | The AI provider receives only codes |
| SRA Code of Conduct, 6.3; ICAEW Code of Ethics | Confidentiality of the client's affairs | Local proof of what the AI received; a seal your client can verify |
What Hidden Tokens recognises today, and what is missing
We tested the engine on a fictitious British letter on 27 October 2026. Here is what it found, as it stands:
- Coded Names, addresses and postcodes, email addresses, company numbers (Companies House), passports, driving licences.
- Coded, but under the wrong type The NHS number (treated as a phone number).
- Not covered yet The sort code and account number, UK mobile numbers (07…), part of the National Insurance number. English is sometimes over-coded ("National Insurance" taken for a name).
Until the UK identifiers pack ships, we offer UK organisations the pilot only, and say so, and we add these formats (sort code, account number, UK mobile numbers, NI number) to your organisation's policy as pattern rules, so they are always coded.
Prices (excl. VAT)
| Solo, 1 seat | Firm, 2 to 20 seats | Organisation, 21 to 100 seats | 101 to 500 seats |
|---|---|---|---|
| £26 / month billed £312 / year | On quote | On quote | On quote |
For the first ten customers in the UK on the Firm or Organisation plan: one day of on-site rollout free (travel costs extra).
Until our online checkout takes pounds, UK orders are invoiced by us at these prices. 14-day trial, no account, no card.
What Hidden Tokens doesn't cover yet in the UK
- The UK identifiers pack (see above).
- UK identifiers in the leak scanner: it works in English, but counts sort codes, UK mobiles and NI numbers only once the UK pack ships.
- The licence agreement, the framework agreement and the DPIA template in English.
And, as everywhere: Hidden Tokens supports your compliance; it doesn't certify it. It protects what goes through it: text pasted by hand into the chat isn't covered.
This sheet is not legal advice: the references should be confirmed by your counsel or your DPO. Hidden Tokens · hiddentokens.com · info@hiddentokens.com · WhatsApp +212 680 092 567
Next steps. 14-day trial: hiddentokens.com/#download · 15-minute leak test or pilot: WhatsApp +212 680 092 567 or info@hiddentokens.com · Shadow AI diagnostic: hiddentokens.com/shadow-ai-diagnostic · AI policy generator: hiddentokens.com/ai-charter