What happens to the data you paste into DeepSeek, and should you block it at work?
DeepSeek stores what your staff type on servers in China. For most UK firms handling client data, the sensible answer is yes: block DeepSeek at work, then give staff an approved AI tool so the work still gets done. Blocking alone tends to push people onto phones. A block plus a clear alternative is what holds.
Where your data goes
DeepSeek is a Chinese AI chat service. It works much like ChatGPT. You type a question. It answers.
The difference is where the text ends up. According to a summary of chat-deep.ai, DeepSeek Privacy Policy Explained, DeepSeek's privacy policy states that personal data is directly collected, processed and stored in the People's Republic of China. There is no option to pick a US or EU data centre for the hosted app or API.
So if Priya at Ashcombe pastes a client's payroll into DeepSeek, that payroll is now in China. It cannot be pulled back.
Why it matters under UK GDPR
Sending personal data outside the UK is allowed. But there are rules. The country needs an adequacy decision, or the transfer needs proper safeguards. China has no UK adequacy decision.
European regulators have taken this seriously. The Berlin Commissioner for Data Protection said in June 2025 that DeepSeek transfers user data to Chinese processors and stores it in China. It alleged a breach of GDPR Article 46(1), because the EU has not issued an adequacy decision for China. That is set out by chat-deep.ai, DeepSeek Data Residency.
Others went further. VinciWorks reports that Italy's regulator, the Garante, ordered DeepSeek to block its app in Italy. The Netherlands banned the app on government devices.
What the ICO has done
The UK regulator has looked too. MLex reported that the ICO opened an investigation in February 2025. It had "written to DeepSeek, requesting information on its approach to data protection for UK residents".
On 8 October 2026 the ICO published the outcome of its review of large AI developers. ActuIA reports DeepSeek was one of ten that changed, or committed to change, their practices. The others included Microsoft, Google, OpenAI and Anthropic. DeepSeek has produced a legitimate interest assessment. It must explain which third-party personal data are in its training data, and why.
That is progress. It does not move the servers. Your client's data still goes to China.
Rule of thumb: if a piece of text names a client or a person, it should not go into DeepSeek. If staff cannot reliably tell the difference, block it.
Three ways to block DeepSeek at work
You do not need a big firewall. Pick the tier that fits your size.
1. Block it on the network
This stops DeepSeek on anything using your office internet. Many business routers and DNS filtering services let you block named websites. DNS filtering means the service refuses to look up the address, so the site will not load.
Firewall administrators use the same idea. A guide on Blog: Blocking DeepSeek on Palo Alto firewalls describes a custom list of DeepSeek's known domains, such as deepseek.com, deepseek.net and deepseekv3.net, set to block.
Good for: small offices where everyone works on site.
Falls short: laptops at home or on hotel Wi-Fi are not covered. New domains need adding by hand.
One thing that does not work here: robots.txt. That file only asks DeepSeek's crawler not to read your website. The cside Blog notes it only works if the crawler chooses to respect it. It also does nothing to stop staff using DeepSeek.
2. Block it on each PC or browser
This follows the laptop wherever it goes. Options include browser policies in Chrome and Edge, Microsoft Intune if you use it, or a tool installed on each computer.
Good for: hybrid teams. Firms with an IT provider who can push settings out.
Falls short: it needs setting up per device. Personal phones are still outside it.
3. Policy plus an approved tool
Write a short AI policy. Say which tools are allowed and what must never be pasted. Get each person to agree to it. Then give them a tool that meets your data rules.
Good for: every firm, alongside one of the blocks above.
Falls short: a policy on its own relies on memory. People slip on a busy afternoon.
Which approach fits a small firm
| Your firm | Sensible setup |
|---|---|
| Everyone in one office | Router or DNS block, plus a policy |
| Hybrid or remote staff | Browser or PC block, plus a policy |
| Uses an IT provider | Ask them for both layers, and an approved tool |
Whatever you pick, name the alternative. If staff find AI useful, a bare block sends them to their phones. Tell them what they can use instead.
Choosing that tool is its own question. Our guide on whether Microsoft Copilot is safe for client data covers what to check.
Blocking DeepSeek is only half of it
A block covers one site. The same risk sits with any AI tool. Tom can paste a client list into ChatGPT just as easily.
This is where Helio Guard fits. It adds an extension to Chrome and Edge on each Windows PC. It checks pastes, messages and file uploads on listed AI sites, DeepSeek included. Sensitive items such as bank details or National Insurance numbers are taken out or swapped for labels. The question still goes. Checked on the PC, with fixed rules. We never see what your team types. It also records each person's dated agreement to your AI policy, and flags unapproved AI tools. It is Windows only.
It costs £1 a person a month, from 5 people. There is a 14-day free trial, no card needed. You can see the details on our pricing page.
Common questions about blocking DeepSeek
Is it illegal to use DeepSeek at work in the UK?
Using DeepSeek at work is not illegal in the UK. The risk is putting personal data into it. Under UK GDPR, your firm is responsible for that data, and sending it to servers in China without proper safeguards can break the transfer rules. Using DeepSeek for general questions with no client or personal details is a different matter.
Does blocking the DeepSeek website stop the phone app?
Blocking the DeepSeek website on your network stops the phone app only while the phone uses your office Wi-Fi. On mobile data, the app works as normal. Blocking on each PC does not touch phones at all. That is why a written AI policy matters alongside any technical block.
Does the ICO review mean DeepSeek is now safe for client data?
The ICO review means DeepSeek committed to changes, such as a legitimate interest assessment and clearer notes on training data. It does not change where the data is stored. DeepSeek's policy still says personal data is stored in China, so client data should still stay out of it.
Related: Browser extension vs firewall for blocking AI tools: which suits a small firm?