Guidance on AI and Data Protection
United Kingdom · Guideline · Information Commissioner's Office
Our summary
Non-binding guidance from the UK's independent authority for data protection, explaining how organisations should apply data protection principles when developing and using AI systems. It covers accountability, transparency, lawfulness, accuracy, and fairness in AI, with guidance on managing bias, automated decision-making, and protecting vulnerable groups.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
7 sections
Jump to a chapter
What are the accountability and governance implications of AI?
This chapter addresses accountability and governance considerations for AI systems. It includes updated content on matters to evaluate as part of a data protection impact assessment.
How do we ensure transparency in AI?
This newly created chapter provides overview-level information about how transparency obligations apply when using AI systems. Detailed guidance on transparency and how to explain AI-driven decisions is available in a separate product.
How do we ensure lawfulness in AI?
This chapter covers lawfulness requirements for AI systems and includes new material on AI-driven inferences, affinity groups and special category data. It consolidates content previously scattered across other sections.
What do we need to know about accuracy and statistical accuracy?
This chapter addresses accuracy principles for AI systems, including statistical accuracy as a key consideration for fairness. Content was reorganised from prior chapters to align with data protection principles.
Fairness in AI
This chapter explains fairness within data protection and its application to AI, covering the distinctions between fairness, algorithmic fairness, bias and discrimination. It discusses evaluation considerations, bias mitigation through data processing and technical approaches, and the connection between automated decision-making safeguards and fairness under the UK GDPR.
Annex A: Fairness in the AI lifecycle
This annex examines how fairness considerations apply across the AI lifecycle from initial problem formulation through decommissioning. It explains how design choices such as underlying assumptions, problem abstractions, target variable selection and reliance on quantifiable proxies can affect fairness, identifies sources of bias and describes possible mitigation approaches.
Glossary
This section provides definitions of key terms used in the guidance, including recently added definitions for affinity groups, algorithmic fairness, various algorithmic and data processing concepts, and AI development practices.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.