# ICO Guidance on AI and data protection

- **Record type**: Policy instrument
- **Jurisdiction**: United Kingdom
- **Instrument type**: Guidance
- **Status**: Guidance
- **Binding**: No — guidance, strategy or standard
- **Issuing body**: Information Commissioner's Office

## In brief

The ICO AI guidance is a non-binding guidance of the United Kingdom, issued by the Information Commissioner's Office. Its current status is guidance. Any controller or processor using personal data in AI systems in the UK, at any lifecycle stage. 2 obligations are recorded against it, each with its source reference.

## Summary

The ICO's guidance explains how UK GDPR and the Data Protection Act 2018 apply when organisations develop or use AI that processes personal data. It covers accountability and governance, lawfulness and fairness, transparency, data minimisation, security, individual rights, and automated decision-making. The guidance is not itself law, but it reflects how the regulator interprets binding obligations and is the reference point in ICO enforcement.

## Scope

Any controller or processor using personal data in AI systems in the UK, at any lifecycle stage. It does not apply to AI that processes no personal data.

## Who it applies to

Controllers and processors under UK GDPR, including developers and deployers of AI.

## What organisations must do

Complete a data protection impact assessment for high-risk AI, document lawful bases, provide meaningful information about automated decisions, implement safeguards for solely automated decisions with legal or similarly significant effects, and test for bias and accuracy.

## Key dates

First published July 2020, updated March 2023. Consultations on generative AI and data protection ran in 2024. The Data (Use and Access) Act 2025 changed the rules on automated decision-making, so a reviewer should confirm the current version.

## Penalties

Underlying UK GDPR breaches can attract fines up to GBP 17.5 million or 4 % of global annual turnover.

## Obligations recorded against this instrument (2)

- **Carry out a data protection impact assessment for high-risk AI processing** (UK GDPR Article 35; ICO guidance, accountability and governance section) — Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI involving profiling, large-scale processing or novel technology as meeting this threshold.
  - Binding: yes
  - Record: https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai
- **Apply safeguards to solely automated decisions with significant effects** (UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025) — Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.
  - Binding: yes
  - Record: https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards

## Provenance

- **Permanent id**: AIPT-POL-0203 (https://aipolicytracker.org/id/AIPT-POL-0203; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance
- **Official source**: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- **Source document**: Guidance on AI and data protection
- **Published by**: Information Commissioner's Office
- **Provision**: ICO guidance hub
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "ICO Guidance on AI and data protection" [AIPT-POL-0203, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0203 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.