UK GDPR and AI after the Data (Use and Access) Act

At a glance

What this is: This guide maps how UK GDPR and the Data (Use and Access) Act now apply to AI systems that handle personal data, with emphasis on lawful basis, automated decisions, complaints handling and transfers.

Why it matters: It matters because AI programmes now need evidence for lawful processing, human review and rights handling, and those obligations reach embedded vendor tools as well as custom-built systems.

By the numbers:

• Most Data (Use and Access) Act reforms took effect on 5 February 2026, including the new automated decision-making rules in Articles 22A to 22D.
• Mandatory complaints handling began on 19 June 2026, and organisations must acknowledge complaints within 30 days and respond without undue delay.
• The European Commission renewed the UK's adequacy decisions on 19 December 2025, and they now run until 27 December 2031.
• Maximum UK GDPR fines remain the higher of £17.5 million or 4% of global annual turnover.

Context

UK GDPR still applies when AI systems process personal data in prompts, retrieved context, training data or outputs, and the Data (Use and Access) Act changed how teams must think about automated decisions, complaints and cross-border transfers. The law did not remove the accountability burden; it shifted the detail of what organisations need to evidence.

For security and privacy teams, the practical problem is governance drift: the legal framework changed faster than many operating models, so controls, records and vendor terms can lag behind the current rule set. That makes this a GDPR compliance guide for security teams problem as much as a legal one.

Key questions

Q: What breaks when UK GDPR controls are not built into AI workflows?

A: The main failure is that personal data moves through prompts, logs, context stores and outputs faster than the organisation can prove lawful processing or rights handling. That creates weak accountability, poor minimisation and a breach path that is hard to reconstruct. If the workflow cannot show who accessed what, why and under which basis, the governance model is already failing.

Q: When should organisations prioritise human review over fully autonomous AI decisions?

A: Organisations should prioritise human review whenever the decision carries legal, safety, ethical, or reputational consequences. That includes areas such as diagnosis, access decisions, financial judgement, and autonomous action. Human review is also appropriate when the model is poorly understood, the data is sensitive, or the cost of a wrong outcome is difficult to reverse.

Q: What are the signs that AI privacy controls are failing in practice?

A: Common warning signs include unclassified training data, unexplained data drift, sensitive output leakage, unauthorized model use, and gaps between legal policy and technical enforcement. If teams cannot trace what data a model used, where it came from, and whether it is still governed, the privacy programme is already operating with dangerous blind spots.

Q: Who is accountable for GDPR compliance when using third-party AI services?

A: The organisation remains accountable for its own use case, even if a vendor supplies the model or embedded feature. In practice, that means the buyer must assess purpose, lawful basis, transfer terms, rights handling and the evidence needed for an inquiry. Vendor assurances help, but they do not replace the controller's responsibility.

Technical breakdown

How UK GDPR applies to prompts, models and outputs

UK GDPR applies whenever personal data appears anywhere in the AI workflow, not just in the final output. That includes prompts, retrieved context, training sets, telemetry, logs and downstream summaries. The governance mistake is to treat the model as a privacy boundary when the real processing chain spans multiple systems and vendors. Security teams therefore need data flow visibility, purpose mapping and evidence that each system has a lawful basis for the data it touches. The controls are not only legal documents. They are inventories, access limits, retention rules and logging that show how personal data moves through the environment. See the Identity Data Privacy and Consent Guide.

Practical implication: Map every AI data path and tie it to a documented lawful basis, retention rule and access control.

Automated decisions need meaningful human involvement

The new Articles 22A to 22D keep significant automated decisions under stricter governance even as some lawful-basis rules loosen. A decision is not meaningfully human simply because a person clicks approve after the system has already determined the outcome. The control question is whether the human can review evidence, disagree, change the result and do so within a logged process. That means AI workflows need review queues, escalation paths and records that show the human actually influenced the decision. For significant decisions involving special category data, the threshold remains even tighter. Read GDPR Compliance Guide for Security Teams.

Practical implication: Design review workflows that let humans change outcomes, not just rubber-stamp them.

International transfers now depend on stronger contract and governance checks

The Act changed the transfer test, but the practical issue for practitioners is still the same: where data is processed, who can access it and what contractual limits exist on reuse. AI suppliers may process data in multiple regions, through sub-processors, and for their own service improvement unless the contract says otherwise. That makes transfer governance inseparable from procurement and vendor management. Teams should be able to prove the destination, the legal mechanism and the controls that protect both EU-origin and UK-origin personal data. Adequacy helps, but it does not replace due diligence.

Practical implication: Review sub-processor chains, data residency claims and reuse clauses before approving AI deployments.

Threat narrative

Attacker objective: The objective is to obtain, expose or misuse personal data through AI processing paths that the organisation cannot adequately govern.

1. Entry occurs when personal data enters an AI workflow through prompts, uploaded documents, training data or tool calls that were not designed with privacy boundaries in mind.
2. Credential or policy abuse follows when an agent, vendor workflow or internal user reaches data that exceeds the declared purpose or access scope.
3. Escalation happens when the system reuses, logs or exposes that data across outputs, tools, analytics or model behaviour in ways the organisation cannot easily trace back.
4. Impact is a personal data breach, rights failure or unlawful transfer exposure that can trigger complaints, regulatory scrutiny and penalties.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

UK GDPR for AI is now a control problem, not a policy problem. The article makes clear that the law now reaches prompts, training sets, retrieved context and outputs, which means governance has to be enforced in the technical path where personal data is actually processed. That shifts responsibility from privacy notices alone to inventories, retention controls, access restrictions and decision records. Practitioners should treat AI privacy as an operational security discipline, not a documentation exercise.

Meaningful human involvement is the real test in automated decision-making. The Act softened some lawful-basis constraints, but it did not change the need for genuine human intervention where decisions are significant. In practice, organisations often confuse sign-off with review, and that weakens the whole safeguard model. The control gap is not the absence of a reviewer, but the absence of reviewer authority, context and traceable disagreement. Teams should assume regulators will look for evidence that humans could actually change the outcome.

The privacy boundary now extends into vendor architecture and model behaviour. The guide is right to focus on roles, sub-processors and data reuse, because AI suppliers can shape how personal data is processed long after the initial collection point. That is where the AI and privacy guide becomes relevant: the boundary is not just legal ownership of data, but whether the system design prevents unnecessary reuse and identifiability. Practitioners should demand a model of accountability that survives vendor substitution and service change.

Identity data governance is now inseparable from AI governance. When an AI system can find, infer or reproduce personal data across prompts and outputs, the organisation needs the same discipline it would apply to any sensitive identity flow. This includes minimisation, role-bound access, retention control and complaint handling that can stand up to an ICO inquiry. The practical conclusion is straightforward: if you cannot explain the data path, you cannot defend the decision.

What this signals

AI privacy governance now depends on control evidence, not policy language. The organisations most likely to struggle are those that treat AI as a special case outside ordinary data handling. In reality, the evidence trail needs to show minimisation, access limitation, retention and complaint handling across the full processing chain, especially when third-party tools are involved.

The named concept here is identity data governance drift: the gap that appears when data handling rules, vendor contracts and runtime controls no longer describe the same system. That drift is especially dangerous in AI because personal data can surface in prompts, retrieved context and outputs even when the original deployment looked low risk. Teams should assume that the harder it is to trace the data path, the more likely the governance model has fallen behind.

The regulatory pressure will intensify as the ICO finalises its AI code and organisations continue to rely on external models and embedded features. Practitioners should expect more scrutiny of human intervention, transfer controls and vendor role definitions, especially where AI touches personal data at scale.

For practitioners

• Inventory every AI system that touches personal data Include embedded AI features, agent workflows, prompts, logs, retrieved context and vendor-hosted services so you can prove where personal data enters and leaves.
• Document lawful basis and purpose for each AI use case Record the specific purpose, lawful basis, data categories and any balancing assessment for each deployment, then revisit it when the model, vendor or data source changes.
• Build real human review into significant decisions Create an escalation path where a reviewer can see the evidence, change the outcome and leave an audit trail for decisions that may be solely automated.
• Harden vendor terms for data reuse and transfers Check whether the supplier trains on your data, where sub-processors operate, how rights requests are supported and what audit evidence you can obtain.
• Stand up a complaints and rights evidence trail Make sure the organisation can acknowledge complaints within 30 days, identify relevant records quickly and show how it can locate, correct or erase an individual's data.

Key takeaways

• AI systems are not outside UK GDPR simply because they are automated; if they process personal data, the same accountability, minimisation and rights obligations apply.
• The Data (Use and Access) Act changed the mechanics for automated decisions, complaints and transfers, but it did not remove the need for evidence that controls work in practice.
• For practitioners, the decisive control is traceability across the full AI data path, from prompt to output to vendor handling and back to the rights request trail.

Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · Identity Data Privacy and Consent Guide · Identity Security Regulatory Map · AI and Privacy Guide

Key terms

• Lawful Basis: The legal reason an organisation is allowed to collect and process personal data under GDPR. In practice, it must be specific, documented, and matched to the actual processing activity. If access or use drifts beyond that purpose, the compliance position weakens quickly.
• Significant Automated Decision: A decision made solely by automated processing, including profiling, that has a legal or similarly significant effect on an individual. In governance terms, this triggers stricter safeguards, clearer explanations and a credible human review path.
• Data Protection Impact Assessment: A Data Protection Impact Assessment is a structured review of how a system, change, or transfer could affect personal data privacy. It is used to identify risk before implementation, especially where new processing, new jurisdictions, or new access paths might increase exposure.
• Meaningful Human Involvement: Human participation in a decision process that can genuinely influence the outcome, not merely rubber-stamp it. The reviewer must have enough context, authority and time to disagree, escalate or change the result, and that activity should be recorded.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is a fit for teams that need to connect identity governance to broader security and privacy programmes.