SurveyMonkey launches Trust Centre as UK firms face AI privacy risks

SurveyMonkey has launched its new Trust Centre and published data highlighting persistent challenges for British businesses in complying with the General Data Protection Regulation (GDPR), as concerns mount over the impact of artificial intelligence on data privacy.

SurveyMonkey's research found that 40% of surveyed UK businesses believe artificial intelligence (AI) and machine learning will present the most significant privacy and security challenges in the coming year.

The survey, which polled 571 UK business decision makers, revealed that AI adoption is already prevalent, with 89% of UK businesses reporting some level of implementation. Despite widespread understanding—95% of respondents claimed to understand and meet all requirements of GDPR—over half (52%) admitted to having experienced data-related issues since the regulation came into force.

Of these businesses, one in six (16%) have faced a GDPR-related fine or penalty, while 18% reported undergoing an official warning or investigation by a Data Protection Authority.

Budget constraints continue to be a major concern for companies seeking to improve their security practices. Nearly a quarter (23%) of all surveyed businesses cited lack of funds as the greatest barrier to bolstering their security. This issue is particularly acute among smaller businesses, with 33% of organisations employing 50 staff or fewer naming budget as a primary obstacle, despite 46% of respondents expressing intentions to increase security investment in the next year.

Legacy technology also emerged as a challenge for businesses seeking to enhance their data protection capabilities. One in five (21%) respondents identified outdated systems as a significant hurdle to achieving stronger privacy protections. In response, a third (33%) of UK businesses have either recently invested in or are planning to procure technology solutions such as encryption, data loss prevention, and privacy management software.

High-profile incidents involving large UK retailers and food chains have emphasised the importance of robust data privacy. The study found that 40% of UK businesses now only partner with vendors who clearly outline their data protection measures. The new SurveyMonkey Trust Centre aims to support procurement and IT teams by providing transparent details of the company's privacy, security practices, certifications, compliance measures, and third-party audit standards, enabling more informed decisions about data handling and vendor risk.

AI was not the only technological development flagged as a risk area. Respondents identified cloud computing platforms (28%), the internet of things (25%), and big data analytics (25%) as other emerging technologies likely to test privacy and security in the next year. Alongside these risks, many companies have begun to take steps to address AI's impact on privacy compliance. Over two-thirds (70%) of respondents reported that their businesses have already established or are developing policies and guidelines to manage AI-related privacy issues.

Additional preventative measures include updating privacy policies (31%), exclusively partnering with vendors who provide transparent AI and data handling practices (31%), restricting use of certain AI applications (27%), and providing targeted AI and data privacy training to staff (27%). These measures are intended to help organisations not only comply with GDPR but also respond to the requirements of the EU AI Act, which affects UK businesses selling AI products and services in the European Union.

The research also points to the role of compliance in fostering customer trust and commercial success. Among respondents, 92% indicated that adhering to GDPR and data privacy legislation had provided their organisations with a competitive edge by strengthening customer trust, while 85% expressed confidence that their clients fully trusted the company's data privacy practices.

A large majority of surveyed organisations (82%) have updated their data protection policies in the past two years; 36% of them did so in the past six months. An equal percentage have a dedicated Data Protection Officer in post or plan to appoint one shortly. Confidence in third-party vendors was also high, with 91% reporting trust in their service providers' data handling.

This trust, however, is contingent on demonstrable compliance. The study found that 89% of businesses require clear proof of compliance and security before entering into new partnerships, with widely accessible documentation about a vendor's protection measures playing an increasingly important role. As a result, 78% of respondents said they had ended supplier relationships due to GDPR or data security concerns.

Addressing these findings, Eric Johnson, CEO of SurveyMonkey, said, "Seven years after GDPR transformed how we think about data, many organisations still feel like they're playing catch-up. As AI and big data introduce new layers of complexity, businesses need trusted tools and clear frameworks to meet rising expectations around compliance, security, and transparency. SurveyMonkey has long been a market leader in secure, compliant feedback collection—grounded in insights from real people, not algorithms. We built the Trust Centre to help organisations evaluate us as a partner, strengthen internal accountability, and build lasting customer trust. Good privacy practices shouldn't be a guessing game, and with SurveyMonkey, they don't have to be."