Data Protection

Data protection in the UK is governed primarily by the UK GDPR (the retained EU General Data Protection Regulation) and the Data Protection Act 2018 (DPA 2018). Together these set out the rules on how personal data must be collected, processed, stored and shared. The Privacy and Electronic Communications Regulations 2003 (PECR) impose additional requirements for electronic marketing, cookies and communications metadata. The Information Commissioner’s Office (ICO) is the independent supervisory authority responsible for enforcing these rules. Organisations processing personal data must comply with the data protection principles, establish a lawful basis for processing, and respect individuals’ rights including access, rectification, erasure and data portability.

The UK takes a “principles-based, sector-led” approach rather than a binding horizontal AI statute. The EU AI Act is prescriptive, categorising AI systems by risk and imposing detailed compliance requirements. UK-based organisations working in or selling into the EU may need to comply with both frameworks.

The ICO’s current priorities include data protection compliance in AI and automated decision-making, children’s privacy and the Age Appropriate Design Code, marketing and cookies compliance, international data transfers, and cyber security and breach reporting. The ICO has confirmed it will use its full enforcement powers, including fines, to address non-compliance in these areas.

Obligations depend on context, but typically include:
lawfulness and transparency of data use |
data minimisation and purpose limitation |
meaningful human oversight |
security and robustness controls |
testing and validation to manage bias and accuracy risk |
accountability frameworks, including model governance and documentation |
third-party risk management and contractual controls for AI services and models.

Yes. A formal data protection governance framework is a practical requirement for accountability under UK GDPR. This typically includes a data protection policy, defined roles and responsibilities, records of processing activities, a DPIA process, data breach procedures, data subject rights processes, training programmes and regular compliance reviews.

Compliance requires:
identifying a lawful basis for training |
ensuring training data is fair, relevant and not excessive |
applying appropriate anonymisation or pseudonymisation |
assessing high-risk activities using a DPIA or AI-specific impact assessment |
providing adequate transparency about model training |
managing data subject rights, including the right to object or request erasure if applicable.

Public availability does not remove data protection obligations. If the data includes personal data, a lawful basis is still required. Organisations must also consider the reasonable expectations of data subjects, the purpose of the original publication, and whether further processing is compatible. Copyright, database rights, confidentiality and terms of service may also apply.

Not necessarily. UK GDPR provides six lawful bases for processing: consent, contract, legal obligation, vital interests, public task and legitimate interests. The appropriate basis depends on the purpose and context. Consent is required for direct marketing communications under PECR and may be required for processing special category data. A legitimate interests assessment should be conducted where that basis is relied upon.

Key data protection risks for technology businesses include: inadequate lawful basis for processing | insufficient transparency and privacy notices | insecure international data transfers | vendor and processor compliance gaps | inadequate breach detection and response | non-compliance with data subject rights | excessive data retention | and, for AI-enabled products, risks of bias, automated decision-making without human oversight and opaque processing.

Where personal data is transferred outside the UK, organisations must implement appropriate safeguards. Options include UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), binding corporate rules or specific derogations. A transfer risk assessment is required to evaluate the legal framework and practical enforcement environment in the destination country.

Under UK GDPR, the controller is responsible for compliance regardless of how processing is carried out. Where processors are engaged, controllers must conduct due diligence, enter into compliant data processing agreements under Article 28, and monitor ongoing compliance. Joint controller arrangements require a transparent allocation of responsibilities. Sub-processor chains must be managed contractually and operationally.

Under UK GDPR, personal data breaches likely to result in a risk to individuals must be notified to the ICO within 72 hours. Where the breach is likely to result in a high risk, affected individuals must also be notified. Organisations should maintain a breach register, have documented incident response procedures and conduct post-incident reviews.

The ICO has a range of enforcement powers including information notices, assessment notices, enforcement notices, penalty notices (fines of up to 17.5 million or 4% of global turnover), and prosecution for certain offences. The ICO publishes enforcement actions and regulatory guidance to signal its priorities and expectations.

Consequences of non-compliance include ICO enforcement action and fines, private claims for compensation (including group litigation), contractual disputes, reputational harm and operational disruption. For regulated sectors such as telecoms or financial services, data protection failures can also affect licensing and supervisory relationships.

Yes. Under Article 30 of the UK GDPR, controllers and processors must maintain records of processing activities. These records must include purposes, categories of data subjects and personal data, recipients, international transfers, retention periods and security measures. Records of processing are a core accountability requirement and are routinely requested by the ICO.

Yes. Boards are expected to oversee data protection compliance in the same way they oversee cybersecurity and other legal risks. They should receive regular reporting, approve governance frameworks, ensure adequate resources and understand the organisation’s risk exposure. The ICO has emphasised that accountability starts at board level.

Yes. UK GDPR applies to all organisations processing personal data, regardless of size. However, the ICO adopts a proportionate approach. SMEs may not need a DPO and may use simplified records of processing, but they must still have lawful bases, fair processing notices, security measures and breach procedures in place.

Telecoms providers process large volumes of personal data including traffic data, location data and subscriber information. The Communications Act 2003, PECR and UK GDPR impose overlapping obligations. Data protection compliance must be managed alongside Ofcom’s General Conditions, the Telecommunications (Security) Act 2021 and the electronic communications privacy framework.

A typical starting point includes:
mapping AI use cases |
reviewing data flows and training datasets |
implementing an data governance framework |
completing an AI impact assessment |
updating contracts and third-party arrangements |
aligning policies (data protection, security, acceptable use, procurement) |
conducting staff training |
establishing monitoring and oversight arrangements.