UK data protection regime (UK GDPR and DPA 2018 as amended by the Data (Use and Access) Act 2025)

Inventory every decision point in the product that produces a legal or similarly significant effect for a UK individual (credit or risk refusals, CV screening, account bans, pricing and lending, insurance underwriting, content actions) and determine for each whether there is “meaningful human involvement”. For those that are solely automated, implement and be able to evidence four safeguards: give the individual information about the decision, let them make representations, provide human intervention on the controller’s part, and let them contest the decision. The assessment of meaningfulness must take into account the extent to which the decision is reached by profiling.

Applies when

Controllers taking solely automated significant decisions about individuals in the UK. A vendor supplying the model or score is usually a processor, but may be a controller where it determines the scoring logic itself.

Deadline: Applies from 5 February 2026; complete before launching any new decisioning feature.

Applies from: 2026-02-05

Evidence to retain

• · Automated decision inventory (decision point, input features, output, impact tier, reasoning on whether it is solely automated)
• · Human-intervention design note plus sample intervention records (reviewer authority, evidence that decisions can be overturned)
• · Notice text served to individuals and screenshots of the contest/appeal route
• · Data protection impact assessment and its review record

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

A significant decision based entirely or partly on Article 9(1) special category data (health, biometrics used for unique identification, race, religion, sexual orientation, trade union membership) may not be taken solely automatically unless the data subject has given explicit consent, or the decision is necessary for entering into or performing a contract with the controller, or is required or authorised by law, and Article 9(2)(g) applies. Separately, a significant decision may not be taken solely automatically where the processing relies entirely or partly on Article 6(1)(ea) (recognised legitimate interests). Engineering must be able to show that special category data and its proxies are absent from, or stripped out of, model inputs.

Applies when

Health AI, wearables and health analytics, face or voice recognition, hiring and employee assessment, insurance and credit — any automated decisioning that touches special category data.

Applies from: 2026-02-05

Evidence to retain

• · Feature inventory and screening conclusion for special category data and proxies
• · Memo on the Article 9(2) condition relied on and its legal basis
• · Records of explicit consent capture and withdrawal (where consent is relied on)
• · Technical note and test report on input filtering/masking for the model

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Map every data flow out of the UK to the Chinese parent, overseas cloud, model-training environments and third-party labelling vendors, and put an Article 46 safeguard in place for each: the ICO’s International Data Transfer Agreement (IDTA), the UK Addendum to the EU SCCs, or approved binding corporate rules. Then operationalise the technical and organisational measures the clauses promise (access control, encryption, sub-processor approval, government access request handling) and refresh them when vendors or sub-processors change.

Applies when

Any controller or processor exporting UK personal data, including a Chinese AI company acting as processor for a UK customer and sending data back to China for training or inference.

Evidence to retain

• · Data flow map and restricted transfer register (exporter, importer, data categories, purpose, mechanism)
• · Executed IDTA or EU SCCs plus the UK Addendum, including schedules and the technical measures annex
• · Sub-processor list and onward transfer approval records
• · Government access request handling and notification procedure

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Under the amended Article 46(1A), signing the IDTA or Addendum is not enough: the exporter must, acting reasonably and proportionately, conclude that the data protection test is met for the transfer or that type of transfer — that protection in the destination is not materially lower than under UK law. The assessment must cover rule of law and human rights, the existence and powers of a data protection authority, government access and surveillance law, and the possibility of onward transfer. For transfers into mainland China it must specifically address government access and cooperation duties under the Cybersecurity Law, Data Security Law and PIPL, and the supplementary measures adopted (encryption, key custody outside the destination, minimisation, refusal of requests lacking legal basis). Keep the conclusion on file and review it periodically.

Applies when

Every category of restricted transfer relying on an Article 46 safeguard. Transfers under adequacy regulations (Article 45A) do not need their own assessment, but the regulations must be in force at the time of the transfer.

Applies from: 2026-02-05

Evidence to retain

• · Data protection test / TRA report, tiered by transfer type
• · Analysis of the destination’s legal environment and external legal opinion, if obtained
• · List of supplementary technical and organisational measures with effectiveness verification records
• · Review schedule and the conclusion of the previous review

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Section 78 limits the right of access to what the controller can provide “based on a reasonable and proportionate search”, so define and document in advance: which systems are searched, with what keywords and time windows, and why particular backups or logs are excluded. Section 76 introduces UK GDPR Article 12A, an “applicable time period” that can be paused while identity is confirmed or the scope of the request is clarified. The hard part for AI companies is personal data in training sets, vector stores, prompt logs and model outputs — set an explainable, reproducible search scope before the first request arrives.

Applies when

All controllers processing UK personal data, including Chinese entities serving UK users purely online.

Deadline: Section 78 applies from 19 June 2025 (deemed in force from 1 January 2024); the section 76 response-clock rules apply from 5 February 2026.

Evidence to retain

• · DSAR procedure, including the method for scoping searches and a proportionality reasoning template
• · DSAR log (receipt date, reason and duration of any clock pause, response date, what was provided or withheld)
• · System and data source inventory, recording whether training sets, vector stores and prompt logs are searched and why
• · Response letter templates and exemption reasoning

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

From 19 June 2026 a controller must facilitate complaints that processing infringes the UK GDPR or Part 3 of the DPA 2018, by steps such as providing a complaint form that can be completed electronically; acknowledge receipt within 30 days; and without undue delay take appropriate steps to respond — including making enquiries and updating the complainant — and inform them of the outcome. The Secretary of State may by regulations require controllers to report complaint volumes to the Commissioner, so build the counting capability now.

Applies when

Every business acting as a controller of UK personal data.

Deadline: Acknowledge within 30 days of receipt; applies from 19 June 2026.

Applies from: 2026-06-19

Evidence to retain

• · Online complaint form and sample submission acknowledgement
• · Complaints register (acknowledgement date, investigation record, outcome notification date)
• · Internal complaint handling procedure and escalation rules
• · Monthly/quarterly complaint volume statistics

Estimated first-time effort: 3–8 person-days (estimate, not a commitment)

Complete a DPIA before training, fine-tuning or deploying an AI system on UK personal data and cover, per the ICO’s AI and data protection guidance: separate lawful bases for training and inference; statistical accuracy and fairness including bias testing; data minimisation and privacy-enhancing technologies; security of the model and training data (model inversion and membership inference); and how individuals exercise their rights. Note that the new Schedule 4 recognised legitimate interests basis cannot support processing used for a solely automated significant decision (Article 22B(4)), so check that when selecting a basis. Transparency must explain the model’s purpose, the categories of data sources and the key logic of decisions.

Applies when

Providers and deployers that train or fine-tune models on UK personal data, or deploy AI systems in the UK that affect individuals.

Evidence to retain

• · AI system DPIA, with separate lawful basis analysis for training and inference
• · Evidence of data provenance and licence chain (procurement contracts, crawling policy, public-source documentation)
• · Statistical accuracy and bias test reports
• · Model card / system description and the user-facing transparency notice

Estimated first-time effort: 12–30 person-days (estimate, not a commitment)

Section 70 inserts UK GDPR Article 6(1)(ea) and Schedule 4 “recognised legitimate interests”, which remove the need for a balancing test within that list; section 71 and Schedule 5 list further processing treated as compatible with the original purpose. Re-check the lawful basis recorded for each processing activity, identify what can move to the new basis and what still needs a legitimate interests assessment, and update the privacy notice and ROPA. Note that processing relying on Article 6(1)(ea) cannot be used for a solely automated significant decision.

Applies when

All controllers of UK personal data, especially AI products relying on legitimate interests for product analytics, anti-fraud or security monitoring.

Applies from: 2026-02-05

Evidence to retain

• · Updated ROPA with a lawful-basis mapping table
• · Legitimate interests assessments and their review conclusions
• · Versioned privacy notice with effective dates
• · Cross-check record against the Article 22B(4) restriction

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)