The thing being granted is access, not intelligence
Most AI integration work is about what a model can see. MCP is about what it can do — connect an assistant to your CRM, your ticketing system, your database, your calendar, and let it act.
That inverts the risk. A model that hallucinates in a chat window produces a wrong sentence. A model with a write-capable tool produces a wrong record, in a system of record, that something downstream then relies on. Under UK GDPR, if that record is personal data, you now have an accuracy obligation problem on top of an operational one.
So the design question is never “can it connect” — it can. It is: what is the smallest set of actions that makes this useful, and what does each one touch?
Tools per task, not per system
The default MCP integration exposes a system. The right one exposes a task.
query_database is a standing credential with a natural-language front end. get_order_status(order_id) is a function that does one thing, returns one shape, and cannot be talked into doing something else. Both take about the same time to demonstrate; only one of them is something you can put a data protection assessment against.
Building the second kind means naming every operation during discovery, which is the same exercise that makes the work estimable. The written plan lists each tool, what it reads, what it writes, and whether it needs a human approval step. That document is what your security review actually wants, and it rarely exists for integrations built the fast way.
Read-only first, and not as a formality
We generally propose that the first phase cannot write anything, whatever the eventual scope is.
It is not caution for its own sake. A read-only phase puts the integration in front of real users with real data and produces a real audit trail, and that trail tells you which tools get used, which get used in ways nobody predicted, and which were never needed. Write access designed after watching that is materially narrower than write access designed from a whiteboard — and narrower access is the entire mitigation.
It also means the first thing that goes wrong is recoverable, which is a good property for the first thing that goes wrong.
The audit trail is the compliance artefact
For anything acting on personal data, “what did it do and on whose behalf” is the question you need answerable — during an incident, during a subject access request, and during any conversation with the ICO.
What that means concretely: every tool invocation logged with its parameters, the acting identity, a timestamp and the outcome. Enough to reconstruct the sequence. What it deliberately does not mean is logging full prompts and responses — that quietly creates a second store of the same personal data, typically with a longer retention window than the system it was read from, and it is the kind of thing found during an audit rather than designed.
Retention on the audit log is set explicitly during scoping, like every other store.
Where the transfer happens
The UK page covers where our processing happens and who the sub-processors are. For MCP the specific thing to understand is that the assistant’s model provider sees whatever the tools return.
That makes tool design the transfer control. A tool that returns a whole customer record sends a whole customer record across the boundary every time it runs. A tool that returns the three fields the task needs sends three fields. Same feature, materially different exposure, and the decision costs nothing if it is made while the tool is being written.
Where the assistant runs matters too, and self-hosted or regionally-hosted models are a real option for engagements where the transfer question is the blocker rather than a consideration.
What this changes about the engagement
Discovery produces the tool inventory — every operation, its inputs, its reach, its approval requirement — before any connection is built. Phase one is typically read-only. Audit retention is decided with the rest of the retention policy.
Contracting, currency and hours are as set out on the UK page: quoted and invoiced in USD, contracted under Colorado law, with the working overlap in your afternoon.