ICO guidance on AI and data protection
The UK Information Commissioner's Office guidance on applying data protection law to AI: accountability and DPIAs, lawfulness, accuracy, fairness and bias, security, data minimisation and individual rights. Under review after the Data (Use and Access) Act 2025.
15 March 2023 (under review)
ICO · Oct 2026
Guide
AI & Machine Learning
Information Commissioner's Office (UK)
A few hours for the sections you need
Intermediate
Free
What it is
The UK Information Commissioner's Office (ICO) is the UK's data protection regulator. Its guidance on AI and data protection explains how data protection law, the UK GDPR, applies when organisations build or use AI systems that process personal data. It is one of the most detailed and readable regulator guides on the subject, and its reasoning carries over well to the EU GDPR, which the UK GDPR closely mirrors.
What it covers
- Accountability and governance, including data protection impact assessments (DPIAs) for AI.
- Transparency: what you must tell people about AI processing.
- Lawfulness: lawful bases, inferences and special category data.
- Accuracy and statistical accuracy, and how they differ.
- Fairness: the difference between fairness in data protection law, algorithmic fairness, bias and discrimination, and safeguards for solely automated decisions with significant effects.
- Security and data minimisation in AI systems.
- Individual rights, such as access and erasure, when data sits inside training sets and models.
- Fairness across the AI life cycle, from problem formulation to decommissioning.
Status
The page was last updated on 15 March 2023. As of 2026 the ICO says it is reviewing the guidance because of changes made by the Data (Use and Access) Act 2025, so expect updates and check the page for the current version before quoting it.
Why it matters
Most AI governance work in practice touches personal data, and data protection law already applies to AI today, regardless of AI-specific laws. A DPIA is often the first formal risk document an AI project produces. This guidance shows what a regulator expects to see in one.
How to use it
Read the accountability and fairness sections first. Then take a sample AI use case, such as CV screening or a support chatbot trained on past tickets, and draft a short DPIA outline using the guidance's questions. That draft is a strong portfolio piece for the policy path.
Free or paid?
Free.
Ready to start?
Opens on Information Commissioner's Office (UK) in a new tab.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.