)
Last updated: 16 October, 2026
How do GDPR and AI fit together in the UK after the Data (Use and Access) Act?
The UK GDPR still applies to every prompt, training set and output that contains personal data, and the Act changed four things CISOs must now plan for: automated decisions, lawful bases, complaints handling and international transfers. Most of those changes have applied since 5 February 2026. This guide maps each rule to the technical controls a security team owns and the evidence an ICO inquiry would ask for.
TL;DR: Key Takeaways
- Most Data (Use and Access) Act reforms took effect on 5 February 2026, including the new automated decision-making rules in Articles 22A to 22D (Bratby Law).
- Mandatory complaints handling began on 19 June 2026: organisations must acknowledge complaints within 30 days and respond without undue delay (Farrer).
- The European Commission renewed the UK's adequacy decisions on 19 December 2025, and they now run until 27 December 2031 (RPC).
- An ICO statutory code of practice on AI and automated decision-making is expected to take effect in 2027, and it will cover tools bought from third parties (Arnold & Porter).
- Maximum UK GDPR fines remain the higher of £17.5 million or 4% of global annual turnover (Arnold & Porter).
At a glance: UK GDPR obligations and what they mean for AI
Quick Answer
Does UK GDPR apply to AI?
Yes, whenever an AI system processes personal data, whether in training, in prompts, in retrieved context or in outputs. You need a lawful basis, transparency, data minimisation, security and a way to honour individual rights. The Data (Use and Access) Act relaxed some rules on automated decisions, but kept safeguards for significant decisions and tighter conditions for special category data.
| UK GDPR area | The AI question | What changed or applies in 2026 |
|---|---|---|
| Lawful basis | Which basis covers training and use? | Recognised legitimate interests added, but narrow |
| Automated decisions | Is a significant decision made solely by AI? | Articles 22A to 22D in force since 5 February 2026 |
| Individual rights | Can you find and correct a person's data? | ICO expects identifiability across training data and models |
| Transfers | Does the vendor process data abroad? | New data protection test, adequacy renewed to 2031 |
| Accountability | Can you evidence decisions? | DPIAs, complaints handling and a statutory AI code to come |
)
How GDPR and AI intersect after the Data (Use and Access) Act
The Data (Use and Access) Act amended the UK GDPR and the Data Protection Act 2018 rather than replacing them. Bratby Law (2026) records that its main data protection provisions came into force on 5 February 2026 under SI 2026/82, with the complaints procedure following on 19 June 2026.
For AI teams the practical effect is uneven. Some rules loosened, such as the use of lawful bases other than consent for many automated decisions. Others tightened in practice, because the ICO is writing a statutory code and updating its guidance. Arnold & Porter (2026) reports that the regulations creating the code duty came into force on 12 May 2026, but that the code itself is not expected until 2027.
Treat 2026 as a transition year. The law is settled enough to act on, and the detailed expectations are still being written. Document your reasoning now, so you can show later that you applied the rules as they stood.
Lawful basis for AI: legitimate interests and its limits
Much commercial AI processing relies on legitimate interests, because consent is hard to collect at scale. The Act added a seventh basis, recognised legitimate interests, but Farrer (2026) explains that it covers narrow categories such as national security, crime prevention and safeguarding vulnerable people. Most commercial processing still needs a full legitimate interests assessment.
The ICO's generative AI consultation outcome is stricter about training data. According to Osborne Clarke (2025), the ICO concluded that legitimate interests is likely the only lawful basis for collecting data to train generative models, and that meeting its tests is difficult. Developers need clear, specific purposes, and broad aims such as innovation are not enough on their own. The ICO also saw web scraping as high-risk and flagged that failures of transparency may breach Article 14.
If you buy an AI service, you are less exposed to the training question but still own the use case. Record the purpose, the lawful basis, the balancing test and the data categories for each deployment, and check that the vendor's terms do not reuse your data for its own purposes without your agreement.
Automated decision-making under Articles 22A to 22D
Article 22 has been replaced by Articles 22A to 22D. The ICO's draft guidance defines a significant decision as one based solely on automated processing, including profiling, that has a legal or similarly significant effect, and it treats a decision with no meaningful human involvement as solely automated (ICO, 2026).
Farrer (2026) notes the main change: lawful bases such as legitimate interests can now support automated decisions that do not involve special category data, where previously only narrow conditions applied. The safeguards remain. You must give meaningful information about the decision, allow representations, provide human intervention and let people contest the outcome.
| Decision type | Typical example | Practical control |
|---|---|---|
| Not significant | Internal summarisation, drafting | Standard data protection controls |
| Significant, no special category data | Credit pre-screening, recruitment screening | Safeguards, human intervention route, records |
| Significant, special category data | Health or biometric based decisions | Explicit consent, contract or legal requirement, plus safeguards |
For agents, "meaningful human involvement" is the hard part. A human who clicks approve on every recommendation without context is unlikely to qualify. Design review steps that show the evidence, allow disagreement and are logged.
Generative AI and individual rights
Individual rights are where AI systems most often fail in practice. The ICO's consultation outcome, summarised by Osborne Clarke (2025), says systems should be designed so that specific individuals' personal data can be identified at every stage, including within training data and the model. The ICO also said developers cannot avoid obligations by calling a model anonymous unless they can show people cannot be identified.
On roles, the ICO disagreed with some industry positions. It considers it unlikely that developers act as processors for downstream deployment, because their training decisions shape how personal data is processed in use. Check how your vendor describes its role, and do not assume the answer is "processor".
Requests also have new mechanics. Under Article 12A, in force since 5 February 2026, an organisation can pause the response clock where it reasonably needs more information to identify the scope of a request. This applies only to requests received on or after that date (Bratby Law, 2026). From 19 June 2026, you also need a complaints process that acknowledges within 30 days.
DPIAs, vendors and international transfers
UK GDPR requires a data protection impact assessment before processing that is likely to result in high risk, and AI deployments often qualify. Arnold & Porter (2026) advises reviewing or creating DPIAs where AI or automated decision-making is likely to create high risk, with particular attention to meaningful human involvement, and auditing vendor and procurement terms for AI-specific clauses.
The transfer test has changed. Farrer (2026) reports a new three-step data protection test for restricted transfers, based on a "not materially lower" standard, and updated ICO transfer guidance on 15 January 2026. For UK data coming in from the EU, RPC (2026) reports that the Commission renewed the UK's adequacy decisions on 19 December 2025 until 27 December 2031, while continuing to monitor UK developments.
For vendor contracts, ask five questions:
- Does the vendor use your data to train or improve its models?
- Where is data processed and by which sub-processors?
- What is the vendor's stated role under UK GDPR?
- How are individual rights requests supported?
- What logs and audit rights do you get?
Technical controls for GDPR and AI compliance
CISOs own the controls that make the legal answers true. The table links each principle to a control and the evidence it produces.
| Principle | Technical control | Evidence |
|---|---|---|
| Lawfulness and transparency | Inventory of AI systems, purposes, data categories | Register and privacy notices |
| Data minimisation | Limit what enters prompts and what tools can access | Per-agent permissions and limits |
| Accuracy | Testing of outputs where decisions affect people | Test records |
| Storage limitation | Retention rules for prompts, logs and context stores | Retention schedule |
| Security | Runtime monitoring, access control, red teaming | Monitoring and test logs |
| Accountability | DPIAs, decision records, complaints handling | Dated records |
Start with the inventory. Agent Posture Management (TrustLens) can show which agents and connections exist, which is the precondition for every other control.
How we compared
We used the ICO's own draft guidance for automated decisions, law-firm summaries for the Data (Use and Access) Act commencement and for the ICO's generative AI outcome report, and the RPC summary for adequacy. Secondary summaries can simplify, so check the Act and ICO guidance before relying on a date in a legal document. This guide is not legal advice.
A GDPR and AI checklist for UK CISOs
Use the list to brief your data protection officer.
- Maintain an inventory of AI systems, including vendor-embedded features.
- Record purpose, lawful basis and data categories per system.
- Run a DPIA for high-risk processing and review it when the model or vendor changes.
- Identify decisions that may be significant and solely automated, and design the human review.
- Confirm vendor roles, sub-processors, retention and training use in contracts.
- Test that you can find, correct and erase an individual's data across prompts, logs and stores you control.
- Stand up a complaints process that meets the 19 June 2026 requirement.
- Monitor the ICO's final automated decision-making guidance and the 2027 code.
Security and governance: enterprise risks of AI processing personal data
UK GDPR requires appropriate security for personal data, and AI agents widen the attack surface. Prompt injection can make an agent reveal or send personal data it should not, data can leak through prompts, logs and tool outputs, and an agent with broad tool access can misuse it. A leak caused this way is a personal data breach, with the reporting and penalty exposure that follows.
NeuralTrust approaches this through the Runtime Security Mesh. TrustGate sets per-agent permissions and limits, ships 200+ pre-built MCP servers and acts as a policy and logging point between agents and tools. TrustLens inventories agents and connections. TrustGuard monitors agent behaviour at runtime. TrustTest red teams agents before production. NeuralTrust deploys in your own infrastructure or on-premises, with a managed service hosted in the EU or the US. The platform holds four Gartner Hype Cycle 2026 recognitions, including AI Runtime Defense. For related UK guidance, see our posts on the NCSC's AI guidelines and AI gateway governance.
Which should you choose?
| Your situation | First priority | Why |
|---|---|---|
| Buying SaaS with embedded AI | Vendor role, training use and sub-processor review | You own the use case even when the vendor owns the model |
| Building on an LLM API | DPIA, prompt data minimisation, retention rules | Personal data enters prompts and logs |
| Deploying agents with tool access | Per-agent permissions, logging and human review design | Agents act on data and can produce significant decisions |
| Training or fine-tuning models | Lawful basis, transparency and rights readiness | The ICO is strict on training data and identifiability |
Conclusion
GDPR and AI compliance in the UK comes down to evidence. The Data (Use and Access) Act relaxed some rules on automated decisions and lawful bases, but it kept the safeguards that matter and the ICO is writing a statutory code to follow. Build an inventory, record the lawful basis for each system, design real human review for significant decisions, check vendor roles and contracts, and make sure you can find and correct an individual's data. Do that and a regulator's question becomes a document you already have.
Secure Personal Data in AI Systems with NeuralTrust
Set per-agent limits, monitor tool calls and keep a log you can show your DPO.
)
Related Comparisons
- AI Governance 2026: Frameworks & Tools
- NCSC AI Guidelines for UK Enterprises 2026
- The UK CISO's Complete Guide to Enterprise AI Security (2026)
- Data Sovereignty Checklist for Enterprise CISOs (2026)
FAQs about GDPR and AI
1. Does UK GDPR apply to AI systems?
Yes, whenever personal data is processed in training, prompts, retrieved context or outputs. You need a lawful basis, transparency, minimisation, security and a way to honour individual rights. The Data (Use and Access) Act amended the rules but did not remove them for AI.
2. What changed for automated decisions in 2026?
Article 22 was replaced by Articles 22A to 22D, in force since 5 February 2026. Lawful bases such as legitimate interests can now support many significant automated decisions, but safeguards remain: information, representations, human intervention and a way to contest. Special category data has tighter conditions.
3. Do I need a DPIA for AI?
You need one before processing that is likely to result in high risk, and many AI uses qualify, especially automated decisions about individuals or large-scale processing. Review the DPIA whenever the model, vendor or purpose changes, and record the human involvement design.
4. Is my AI vendor a processor or a controller?
It depends on who decides the purposes and means. The ICO considers it unlikely that model developers act as processors for downstream deployment, because their training decisions shape processing in use. Check the contract and the vendor's own description of its role.
5. Can EU data still flow to UK AI vendors?
Yes. The European Commission renewed the UK's adequacy decisions on 19 December 2025, and they run until 27 December 2031. The Commission continues to monitor UK legal developments, so keep your transfer documentation current.
6. When will the ICO's AI code of practice take effect?
The statutory code on AI and automated decision-making is not expected to take effect until 2027. The ICO consulted on draft guidance on automated decisions between 31 March and 29 May 2026, and the final guidance is expected before the code.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specialises in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognised across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Bratby Law, Data Use and Access Act 2025 Commencement Changes, accessed 16 October 2026.
- Farrer, Data (Use and Access) Act 2025: five key changes for businesses, accessed 16 October 2026.
- RPC, EU Commission renews adequacy decision for the UK's data protection regime, 30 March 2026.
- Arnold & Porter, The ICO's New Statutory Duty to Produce an AI Code of Practice, 17 August 2026.
- ICO, Automated decision-making, including profiling (draft guidance), 31 March 2026.
- ICO, Consultation on the draft guidance about automated decision-making, including profiling, closed 29 May 2026.
- Osborne Clarke, ICO updates its views on using personal data in generative AI, 31 January 2025.
)
)
)
)