QuestionICO AI guidanceAI compliance UKGDPR and AI

What are the key requirements of the ICO's AI guidance?

3 March 2026

Answered by Rohit Parmar-Mistry

Short answer

Where AI processes personal data, UK data protection duties still apply. Map the purpose and lawful basis, minimise what enters the system and assess whether the proposed processing requires a DPIA.

Detailed answer

Use Current ICO Material to Structure the Privacy Review

Start an AI data-protection review by recording what personal data the system uses, for which purpose and where it goes. Have the relevant privacy reviewer assess the lawful basis, data minimisation and whether a DPIA is required for that processing.

Questions to Check Against Current ICO Material

Lawful basis: record each processing purpose and the basis assessed for it; a broad “AI improvement” description does not explain the proposed use
Purpose limitation: assess a proposed training or fine-tuning use before repurposing data collected for another task
Data minimisation: avoid feeding whole records when a small subset will do
Transparency: explain AI use in a way people can understand (what data, why, outcomes, and safeguards)
DPIAs: document risks, mitigations, unresolved issues and the decision about residual risk, rather than treating the assessment as a completed form
Bias and fairness: monitor for discriminatory outcomes and document mitigation
Security: strong access controls, logging, retention, and vendor oversight

AI Risk & Efficiency Audit

What ‘good’ DPIA practice looks like for AI

For an AI use case undergoing a DPIA, work through the lifecycle areas below. Record the assessment and revisit it when the processing or controls change.

data sources, categories, and retention
model purpose and intended outcomes
human oversight and review points
explainability and communications
monitoring: drift, bias, incidents, and changes

Vendor and third-party AI controls

Check where the supplier runs the model, what data it retains and whether it uses your data for training. Review the processing, sub-processor, retention, security and incident terms against those answers; record any gaps that need resolving before the proposed use.

AI Managed AI Governance & Support

Practical next steps

Build an inventory of AI use cases and identify those involving personal data. Use it to prioritise privacy assessment and supplier checks for higher-risk workflows, with a named owner for unresolved questions.

AI Implementation

Need help assessing an AI workflow and its unresolved risks?

Map where AI can improve decisions, service and operations while keeping Consumer Duty, SM&CR, model-risk and client-data controls visible.

Frequently asked questions

Do we always need a DPIA for AI?

Do not decide from the AI label alone. Ask the privacy reviewer to assess the actual processing, including its scale, novelty and potential effects, and record whether a DPIA is required and why.

Does using a third-party model reduce our obligations?

Using a supplier is not a reason to omit the privacy review. Clarify the firm’s and supplier’s roles, how data is processed and which controls each party operates; have the relevant reviewer assess the obligations for that arrangement.

What about anonymised data?

Check the distinction between anonymised and pseudonymised data before relying on either description. Have the privacy reviewer assess the dataset and proposed use rather than treating a supplier’s anonymisation label as sufficient evidence.

What is the most common failure mode?

An incomplete inventory or vague purpose makes review difficult: the team cannot trace which data reaches which system or explain the use. Resolve those gaps before relying on the inventory as evidence for an assessment.

Discuss your next step

Talk through your situation with Rohit, or take the assessment if you need a first read.

Book a Discovery Call Take the AI Readiness Assessment

Back to all questions