ICO Guidance on AI and Data Protection
Issued by
Information Commissioner's Office (the Information Commission from 30 September 2026)
- September 30, 2026 · Source update — Restored this entry's own page. Confirmed the guidance is under review following the Data (Use and Access) Act. (Cody Maxwell)
- September 30, 2026 · Correction — Dated the review to June 2025, removed a retrospective-effect claim, and noted the 30 September 2026 change to the Information Commission (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
- October 12, 2026 · Substantive update — Applied an automated update after editorial review. (Cody Maxwell)
The UK Information Commissioner's Office (ICO) secured commitments from ten major AI developers to strengthen data protection practices covering transparency, individuals' rights, lawful grounds for processing personal data, and safeguards for AI training and deployment. The ten companies named are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. Alongside this, the ICO opened a six-week call for evidence on agentic AI, which refers to AI systems that act autonomously on behalf of users, completing tasks with little or no human input at each step.
Applies To
Overview
The ICO's intervention follows a period of regulatory scrutiny of how foundation model developers, meaning organisations that build large-scale AI systems used as the basis for many downstream products, handle personal data during training and deployment. The secured commitments address four areas: transparency about how personal data is used, individuals' rights to access or object to processing, a lawful basis for each processing activity, and technical safeguards proportionate to the risks involved. Separately, the ICO launched a call for evidence on agentic AI, seeking input on how autonomous AI agents interact with privacy impact assessments, lawful-basis determinations, data subject rights procedures, security controls, and human oversight requirements. The evidence gathered is expected to inform future statutory guidance on AI and automated decision-making under UK data protection law, which applies to any organisation processing the personal data of people in the UK. Organisations that deploy products built on the named foundation models should expect downstream contractual and technical changes as developers fulfil their commitments. The call for evidence signals that formal regulatory guidance specific to agentic AI is forthcoming, and compliance teams should begin assessing their exposure now.
Key Requirements
- •AI developers named by the ICO must implement or have already committed to changes addressing transparency, lawful basis for processing, data subject rights, and training and deployment safeguards, with the ICO monitoring follow-through.
- •Any organisation processing personal data of UK individuals using AI systems must be able to identify and document the lawful basis for each processing activity, including where AI is used in training pipelines or inference.
- •Data subject rights procedures, including the right to access, object, or erasure, must function effectively even where personal data has been processed through an AI model.
- •Organisations deploying agentic AI systems must assess privacy risks through a Data Protection Impact Assessment (DPIA), a structured review required under UK data protection law before undertaking high-risk processing.
- •Human oversight arrangements for agentic AI must be documented and must be sufficient to allow meaningful intervention when automated decisions affect individuals.
- •Failure to comply with UK data protection law can result in ICO enforcement action, including fines of up to 17.5 million pounds or 4 percent of global annual turnover, whichever is higher.
What Your Organization Must Do
- →Audit all AI systems currently in use, including third-party tools built on foundation models from the ten named developers, and verify that each has a documented lawful basis for any personal data processing.
- →Review and update vendor contracts with AI developers to require evidence of the data protection commitments the ICO has secured, and include provisions for notification if commitments change.
- →Conduct or refresh a DPIA for any agentic AI deployment, documenting the scope of autonomous actions the system can take and the personal data it may access or generate.
- →Establish and test data subject rights workflows, such as access and erasure requests, against AI systems to confirm they remain functional where personal data may be embedded in model outputs or logs.
- →Designate a named owner responsible for monitoring the ICO's forthcoming statutory guidance on agentic AI and automated decision-making, and build a response plan for when that guidance is finalised.
- →Submit evidence to the ICO's call for evidence if your organisation uses or develops agentic AI, as early engagement with regulators typically informs guidance in ways that reduce compliance burden later.
Governance Controls
Operational controls that implement requirements from this regulation.