UK ICO Guidance on AI and Data Protection

The Information Commissioner’s Office (ICO) regulates data protection in the UK. Its AI guidance explains how the UK GDPR and Data Protection Act 2018, as amended, apply to systems processing personal data. It covers lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, security and accountability. The guidance does not create a standalone approval route for AI. The DUAA received Royal Assent in 2025. The ICO reported on 19 June 2026 that all its data-protection provisions were in force. The Act widened lawful-basis routes for significant decisions based solely on automated processing, provided appropriate safeguards apply. Those include informing the person, enabling representations, offering human intervention and allowing a challenge. Restrictions remain for special-category data used in such decisions. Human involvement must be meaningful rather than a rubber stamp. The ICO says AI development and deployment often constitute distinct purposes requiring separate analysis. For web-scraped personal data used to train generative AI, it has described legitimate interests as the only available basis under practices it examined. That is a conditional regulatory view, not blanket permission: the controller still must establish a purpose, necessity and a balance that respects people’s rights. Each organisation must examine its own data, safeguards and alternatives. ICO guidance is under revision after DUAA; its current plans list automated-decision and profiling guidance as drafting, with final publication expected in Winter 2026.