UK GDPR

The UK GDPR is the version of the EU's General Data Protection Regulation that the United Kingdom retained after Brexit, supplemented by the Data Protection Act 2018. It sets the rules for collecting, using, storing, and sharing personal data of people in the UK, and it applies to organisations anywhere in the world that process such data. For companies deploying AI, it governs training data, automated decision-making that affects individuals, and the rights people have to explanations and objections, with the Information Commissioner's Office (ICO) as the regulator that can levy fines of up to £17.5 million or 4% of global annual turnover.

1 item

StandardsUK2026-10-24

ICO Sets Binding-Standard Expectations for AI Agents Under UK GDPR

The UK Information Commissioner's Office has published expectations on agentic AI. Organizations must treat AI agent autonomy as a deliberate design choice. It must be backed by proportionate guardrails, defined permissions, and human approval thresholds. The guidance applies existing UK GDPR security and accountability obligations to agentic AI deployments without waiting for new legislation. The ICO also flagged the risk that a security failure in one agent could spread personal data breaches across connected systems.

ICO UK GDPR agentic AI human oversight data protection connected systems UK