AI and data protection in the UK: what UK GDPR and the ICO say about using AI tools

Pasting a customer complaint into a chatbot, asking AI to summarise a recorded sales call or running CVs through a screening tool all involve personal data. Once personal data is involved, UK data protection law applies, whether the tool is a large AI platform or a small add-on in your CRM.

This guide summarises what UK GDPR and the Information Commissioner’s Office (ICO) guidance say about using AI tools, including the automated decision-making changes brought in by the Data (Use and Access) Act 2025. It is general information, not legal advice. The ICO’s AI guidance is being updated after that Act, so check the current versions before you rely on any detail.

Where the rules come from

The ICO’s guidance on AI and data protection explains how the UK GDPR principles apply to AI: accountability, lawfulness, fairness, transparency, accuracy and the rest. The ICO states that the guidance is under review because of the Data (Use and Access) Act and “may be subject to change”. The principles themselves are not new. What AI changes is how easy it is to breach them without noticing, for example by sending customer data to a provider you have not assessed.

Know who is responsible

Under UK GDPR, the controller decides why and how personal data is processed, and a processor acts on the controller’s instructions. The ICO’s accountability guidance says these roles depend on what actually happens, “regardless of how they are described in any contract.” An AI provider that only follows your instructions is likely to be your processor. The same provider may be a controller for training its own models.

The ICO is also clear that accountability cannot be handed off. Senior management remain accountable for AI risks, and overall responsibility for compliance stays with the controller, which for your use of the tool is your business. In practice you need a data processing agreement with the provider and a clear internal owner for each AI tool.

Assess the risk with a DPIA

A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to people. The ICO says that “in the vast majority of cases” the use of AI will involve that kind of processing. You still need to assess each use, and if you decide a DPIA is not needed, you should record your reasoning. If a DPIA shows a high risk you cannot reduce enough, the ICO says you “must consult with the ICO prior to starting the processing.”

A short, honest DPIA for a small business covers what data goes in, why, which provider processes it and where, how long it is kept, what could go wrong for the people involved, and what you will do to reduce those risks.

Have a lawful basis and a clear purpose

Each purpose for processing needs a lawful basis, such as legitimate interests or the performance of a contract. Using customer emails to answer the customer is one purpose. Using the same emails to build a profile of them for marketing is another, and it needs its own justification.

The ICO’s guidance gives specific attention to inferences, because AI can create new personal data by guessing things about people. It also covers special category data, such as health or ethnicity, which needs an additional condition. Be careful with tools that infer sensitive traits from ordinary data.

Tell people what you are doing

The ICO’s transparency guidance says privacy information should cover your purposes, retention periods and who you share data with. If you collect data directly from people, you should tell them at the point of collection, “before you use it to train a model or apply that model on those individuals.” If you obtain the data from elsewhere, you must tell people within a reasonable period and no later than one month.

For most small businesses this means updating the privacy notice to mention AI-assisted processing, naming the kinds of provider involved, and explaining any decisions made with AI support. The ICO’s separate “Explaining decisions made with AI” guidance goes into more depth.

Check accuracy and fairness

AI output about a person can be wrong, and wrong personal data is an accuracy problem under UK GDPR. The ICO says statistical accuracy “remains key for fairness”. If a tool summarises calls, scores leads or flags risky accounts, test it on real cases, look for groups it treats differently, and give staff a simple way to correct its records.

Automated decisions after the Data (Use and Access) Act

The Act replaced the old UK GDPR rule on solely automated decisions with new Articles 22A to 22D. The relevant section came into force on 5 February 2026 under the Commencement No. 6 Regulations. The ICO has published draft updated guidance on automated decision-making for consultation and says it will inform a statutory code of practice on AI and automated decision-making.

Where you make significant decisions about people based solely on automated processing, the draft guidance describes safeguards that include giving people information about decisions, letting them make representations, providing human intervention and letting them contest the decision. Tighter limits apply where special category data is involved. Because the guidance was still in draft at the time of writing, check the final version before designing a process around it.

A human in the loop only counts if the review is real. The ICO’s guidance on individual rights says human involvement “must be active and not just a token gesture”, and that a decision does not escape the rules “just because a human has ‘rubber-stamped’ it.” Reviewers need the authority to override the system and should not be penalised for doing so.

A worked example and common mistakes

An example (illustration only): a ten-person recruitment agency wants to use an AI tool to rank applicants for client roles.

1. It records that it is the controller and the vendor is its processor, and signs the vendor’s data processing agreement.
2. It completes a DPIA, noting the risk of unfair ranking and the absence of human context in the scores.
3. It decides the tool will only sort applications. A consultant reads every CV in the top and bottom groups and makes each shortlisting decision, with authority to ignore the score.
4. It updates its privacy notice and candidate emails to explain that AI helps sort applications and how to ask for a human review.
5. It checks a sample of rankings each month for patterns by gender, age band and other characteristics it lawfully records.

Common mistakes to avoid:

• Staff pasting personal data into free consumer AI tools with no agreement in place.
• Treating a quick human click-through as meaningful review.
• Forgetting to update the privacy notice.
• Assuming the vendor carries the compliance risk.
• Relying on old guidance without checking for updates made after the 2025 Act.