ICO guidance on AI and data protection

What it is

The Information Commission, still known as the ICO, is the UK’s data protection regulator. It replaced the Information Commissioner on 30 September 2026. The ICO has published two main pieces of guidance on AI, plus supporting tools.

Guidance on AI and data protection is a detailed overview of how to apply UK GDPR principles to personal data in AI systems. It was last updated on 15 March 2023. It covers accountability and governance, transparency, lawfulness, accuracy and statistical accuracy, fairness (including bias, discrimination and automated decisions), security and data minimisation, and individual rights. An annex sets out fairness considerations across the AI lifecycle.

Explaining decisions made with AI is co-badged guidance from the ICO and The Alan Turing Institute, published in 2020. It gives practical advice on explaining AI-assisted processes, services and decisions to the people affected. It has three parts, written for data protection officers and compliance teams, technical teams, and senior management.

The ICO also publishes an AI and data protection risk toolkit to help organisations assess risks to individual rights from their own AI systems.

Both guidance documents now carry a notice that they are under review because of changes made by the Data (Use and Access) Act 2025. The ICO’s update of its automated decision-making and profiling guidance is in drafting after a consultation that closed on 29 May 2026, and the final version is listed for winter 2026.

Who it applies to

The guidance applies to any organisation that processes personal data in AI systems and falls under UK GDPR. That includes organisations established in the UK, and organisations elsewhere that offer goods or services to people in the UK or monitor their behaviour there.

It covers both developers and users of AI. An organisation buying an AI product from a vendor is usually the controller for the personal data it puts through that product, so it carries the obligations the guidance describes even where it did not build the model.

What it requires

The guidance sets out how the ICO expects existing legal duties to be met. The core practices are these.

Accountability and governance. Senior management must understand and own the data protection risks of AI. Organisations should work out whether they act as controller or processor at each stage, document their decisions, and carry out a data protection impact assessment. UK GDPR requires a DPIA where processing is likely to result in a high risk, and the ICO’s view is that most AI involving personal data will meet that threshold.

Lawfulness and purpose. Each stage of the AI lifecycle, such as training and deployment, may have a different purpose and need its own lawful basis.

Accuracy and statistical accuracy. Personal data must be accurate, and AI outputs must be treated as statistically informed estimates, not facts. Organisations should measure and monitor a system’s statistical accuracy and account for drift once it is in use.

Fairness. Processing must be fair. Organisations should identify and mitigate bias and discrimination risks through the lifecycle, and the guidance links fairness to the rules on solely automated decisions with significant effects.

Security and data minimisation. AI introduces specific security risks, such as attacks that infer training data. Organisations should use only the personal data they need and apply privacy-enhancing techniques where suitable.

Individual rights. People’s rights of access, rectification, erasure and objection apply to personal data in training data and outputs, and to decisions made about them.

Explaining decisions. Explaining decisions made with AI sets four principles. Be transparent, be accountable, consider the context you are operating in, and reflect on the impact of your AI system on the individuals affected and on wider society. It describes six types of explanation that organisations can choose from and combine.

• Rationale. The reasons behind a decision, in plain, non-technical terms.
• Responsibility. Who develops, manages and deploys the system, and who to contact for a human review.
• Data. What data was used in the decision and how.
• Fairness. The steps taken to make decisions unbiased, and whether the person was treated equitably.
• Safety and performance. The measures taken to maximise accuracy, reliability, security and robustness.
• Impact. How the system’s effects on individuals and society were considered and monitored.

Key dates

• 2020. Explaining decisions made with AI published with The Alan Turing Institute.
• 15 March 2023. Guidance on AI and data protection last updated.
• 5 February 2026. UK GDPR Articles 22A to 22D in force. Both documents placed under review.
• 31 March to 29 May 2026. Consultation on draft guidance on automated decision-making and profiling.
• 12 May 2026. Regulations in force requiring the ICO to prepare a statutory code of practice on AI and automated decision-making.

How it relates to other frameworks

This guidance is the ICO’s reading of UK GDPR, so it sits under the binding rules in the UK GDPR, including Articles 22A to 22D on significant automated decisions. Its fairness, transparency and accountability themes match three of the UK government’s five cross-sector AI principles, and the ICO is one of the regulators expected to apply those principles.

For organisations also processing EU personal data, most of the practices carry across to the EU GDPR, but the rules on automated decisions now differ. The EU AI Act adds its own obligations for high-risk AI alongside data protection law.

The practices also map onto management system and risk frameworks. A DPIA and the explanation types fit within ISO/IEC 42001’s impact assessment and transparency controls, and the accuracy and drift monitoring the ICO expects corresponds to the NIST AI RMF’s Measure function.