NästaNästa guide
UK Data (Use and Access) Act and Automated Decisions
Samhälle
SamhällsGUIDE
UK ICO Guidance on AI and Data Protection
UK organisations using personal data in AI remain subject to data-protection law, as amended by the Data (Use and Access) Act 2025 (DUAA).
På denna sida3 min läsning
Översikt
ICO guidance explains how those rules apply, but it is not a general AI statute and is being updated to reflect the new law.
Djupdykning
The Information Commissioner’s Office (ICO) regulates data protection in the UK. Its AI guidance explains how the UK GDPR and Data Protection Act 2018, as amended, apply to systems processing personal data. It covers lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, security and accountability. The guidance does not create a standalone approval route for AI. The DUAA received Royal Assent in 2025. The ICO reported on 19 June 2026 that all its data-protection provisions were in force. The Act widened lawful-basis routes for significant decisions based solely on automated processing, provided appropriate safeguards apply. Those include informing the person, enabling representations, offering human intervention and allowing a challenge. Restrictions remain for special-category data used in such decisions. Human involvement must be meaningful rather than a rubber stamp. The ICO says AI development and deployment often constitute distinct purposes requiring separate analysis. For web-scraped personal data used to train generative AI, it has described legitimate interests as the only available basis under practices it examined. That is a conditional regulatory view, not blanket permission: the controller still must establish a purpose, necessity and a balance that respects people’s rights. Each organisation must examine its own data, safeguards and alternatives. ICO guidance is under revision after DUAA; its current plans list automated-decision and profiling guidance as drafting, with final publication expected in Winter 2026.
Strategisk inverkan
Risk och säkerhet
Katastrofala och vardagliga AI-skador beror båda på vem som förstår riskerna och vem som kan agera.
Tydligare beslut
Offentlig och professionell läskunnighet formar om en stark säkerhetspolitik är politiskt möjlig.
Skär igenom hypen
Tydliga förklaringar minskar fångst av hype, labb-PR och vag etikteater.
The Future of UK ICO Guidance on AI and Data Protection
The ICO is updating AI-related material following DUAA, including its automated-decision and profiling guidance. Updated materials may clarify practical expectations, while current statutory duties already apply. Track final guidance and any statutory code separately from draft consultations and strategy statements. Data protection compliance also does not settle copyright, equality, consumer or sector-specific obligations. Prioritise the pending ADM guidance update and check the ICO’s live project stage before treating any draft as settled. Maintain separate records for controller purposes and the safeguards used under DUAA.
Verklig implementering
A developer using web-scraped personal data records a specific training purpose and assesses necessity and people’s expectations before relying on legitimate interests.
A business treats model development and deployment as separate purposes and documents a lawful basis for each.
A lender using significant solely automated decisions informs people, permits representations, provides human intervention and allows challenges.
A health service checks the separate rules for special-category data before using it in an automated decision.
Risker & skyddsräcken
Behandling av existentiell risk som sci-fi medan förmåga sammansatta.
Förvirrande ytproduktsäkerhet med inriktning under hög autonomi.
Lämnar icke-engelska och icke-experta publik med endast lågkvalitativa källor.
Färdplan för genomförande
Separata risker för produktskador, felaktig användning och förlust av kontroll/feljustering.
Fråga vilka bevis som skulle ändra din syn på tidslinjer och svårighetsgrad.
Föredrar primära källor och konkreta utvärderingar framför marknadsföringspåståenden.
Identifiera en handlingsväg: karriär, policy, finansiering eller färdigheter – inte bara medvetenhet.
Fortsätt utforska
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the UK ICO Guidance on AI and Data Protection quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Vanliga frågor
What is UK ICO Guidance on AI and Data Protection?
UK organisations using personal data in AI remain subject to data-protection law, as amended by the Data (Use and Access) Act 2025 (DUAA). ICO guidance explains how those rules apply, but it is not a general AI statute and is being updated to reflect the new law.
What legal role does ICO AI guidance play for a UK organisation?
The guidance applies existing data-protection rules; legislation supplies binding duties.
What did the ICO report in June 2026 about DUAA data-protection provisions?
The ICO updated its page on 19 June 2026 to say all data-protection provisions were in force.
Which safeguards does the ICO list for significant solely automated decisions?
The ICO lists notice, representations, human intervention and contestability as appropriate safeguards.
How should an organisation treat model development and deployment for lawful-basis analysis?
The ICO says development and deployment often involve distinct purposes.
Does DUAA remove the special-category-data restrictions for significant automated decisions?
The ICO summary says restrictions on special-category information remain.
Fortsätt lära dig
Relaterade guider
Fler guider har valts för detta ämne