NesteNeste guide
UK Data (Use and Access) Act and Automated Decisions
Samfunn
SamfunnsGUIDE
UK ICO Guidance on AI and Data Protection
UK organisations using personal data in AI remain subject to data-protection law, as amended by the Data (Use and Access) Act 2025 (DUAA).
På denne siden3 minutters lesing
Oversikt
ICO guidance explains how those rules apply, but it is not a general AI statute and is being updated to reflect the new law.
Dypdykk
The Information Commissioner’s Office (ICO) regulates data protection in the UK. Its AI guidance explains how the UK GDPR and Data Protection Act 2018, as amended, apply to systems processing personal data. It covers lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, security and accountability. The guidance does not create a standalone approval route for AI. The DUAA received Royal Assent in 2025. The ICO reported on 19 June 2026 that all its data-protection provisions were in force. The Act widened lawful-basis routes for significant decisions based solely on automated processing, provided appropriate safeguards apply. Those include informing the person, enabling representations, offering human intervention and allowing a challenge. Restrictions remain for special-category data used in such decisions. Human involvement must be meaningful rather than a rubber stamp. The ICO says AI development and deployment often constitute distinct purposes requiring separate analysis. For web-scraped personal data used to train generative AI, it has described legitimate interests as the only available basis under practices it examined. That is a conditional regulatory view, not blanket permission: the controller still must establish a purpose, necessity and a balance that respects people’s rights. Each organisation must examine its own data, safeguards and alternatives. ICO guidance is under revision after DUAA; its current plans list automated-decision and profiling guidance as drafting, with final publication expected in Winter 2026.
Strategisk innvirkning
Risiko og sikkerhet
Katastrofale og hverdagslige AI-skader avhenger begge av hvem som forstår risikoen og hvem som kan handle.
Tydeligere avgjørelser
Offentlig og faglig kompetanse former om sterk sikkerhetspolitikk er politisk mulig.
Skjærer gjennom hypen
Tydelige forklaringer reduserer fangst av hype, laboratorie-PR og vagt etikkteater.
The Future of UK ICO Guidance on AI and Data Protection
The ICO is updating AI-related material following DUAA, including its automated-decision and profiling guidance. Updated materials may clarify practical expectations, while current statutory duties already apply. Track final guidance and any statutory code separately from draft consultations and strategy statements. Data protection compliance also does not settle copyright, equality, consumer or sector-specific obligations. Prioritise the pending ADM guidance update and check the ICO’s live project stage before treating any draft as settled. Maintain separate records for controller purposes and the safeguards used under DUAA.
Real-World Implementering
A developer using web-scraped personal data records a specific training purpose and assesses necessity and people’s expectations before relying on legitimate interests.
A business treats model development and deployment as separate purposes and documents a lawful basis for each.
A lender using significant solely automated decisions informs people, permits representations, provides human intervention and allows challenges.
A health service checks the separate rules for special-category data before using it in an automated decision.
Risikoer og rekkverk
Behandling av eksistensiell risiko som sci-fi mens evnesammensetninger.
Forvirrende overflateproduktsikkerhet med justering under høy autonomi.
Etterlater ikke-engelske og ikke-eksperter med kun kilder av lav kvalitet.
Veikart for implementering
Separate risikoer for produktskade, misbruk og tap av kontroll/feiljustering.
Spør hvilke bevis som vil endre ditt syn på tidslinjer og alvorlighetsgrad.
Foretrekk primære kilder og konkrete vurderinger fremfor markedsføringspåstander.
Identifiser én handlingsvei: karriere, politikk, finansiering eller ferdigheter – ikke bare bevissthet.
Fortsett å utforske
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the UK ICO Guidance on AI and Data Protection quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Ofte stilte spørsmål
What is UK ICO Guidance on AI and Data Protection?
UK organisations using personal data in AI remain subject to data-protection law, as amended by the Data (Use and Access) Act 2025 (DUAA). ICO guidance explains how those rules apply, but it is not a general AI statute and is being updated to reflect the new law.
What legal role does ICO AI guidance play for a UK organisation?
The guidance applies existing data-protection rules; legislation supplies binding duties.
What did the ICO report in June 2026 about DUAA data-protection provisions?
The ICO updated its page on 19 June 2026 to say all data-protection provisions were in force.
Which safeguards does the ICO list for significant solely automated decisions?
The ICO lists notice, representations, human intervention and contestability as appropriate safeguards.
How should an organisation treat model development and deployment for lawful-basis analysis?
The ICO says development and deployment often involve distinct purposes.
Does DUAA remove the special-category-data restrictions for significant automated decisions?
The ICO summary says restrictions on special-category information remain.
Fortsett å lære
Relaterte guider
Flere guider valgt for dette emnet