AI in the UK: UK GDPR, the ICO and the EU AI Act in practice

Since Brexit, British companies have lived with two regulatory maps. At home, a data protection regime inherited from the GDPR but now amended, and an approach to AI with no single dedicated law. With their European customers, the original GDPR and the EU's AI Act.

For a bank in the City, an insurer in Manchester or a software firm in Edinburgh selling into the continent, the question is very practical: which rules apply when an employee pastes customer data into an AI assistant?

The foundation: UK GDPR and the Data Protection Act 2018

The UK kept the GDPR in domestic law as the UK GDPR, alongside the Data Protection Act 2018. The principles are familiar: lawful basis, data minimisation, security proportionate to risk, and impact assessments for high-risk processing. A prompt containing a customer's name, address or case file is processing of personal data, with the same obligations as a file sent by email.

For years the regulator was the Information Commissioner's Office (ICO). Since 30 September 2026, its functions have moved to a new Information Commission created by the 2025 reform. The guidance the ICO published remains the practical reference.

What the Data (Use and Access) Act 2025 changes

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It is being commenced in stages, and most of its data protection changes have applied since 5 February 2026. For AI projects, three points matter:

• a list of recognised legitimate interests, for which organisations no longer need to run the usual balancing test;

• relaxed rules on solely automated decisions, except where they rely on special category data, with safeguards such as the right to contest the decision and obtain human intervention;

• the replacement of the ICO by the Information Commission.

This is not deregulation. Security, minimisation and transparency duties remain intact. Personal data leaking into a consumer AI tool can still amount to a personal data breach under the UK GDPR.

The ICO and AI: a substantial body of guidance

The ICO has published detailed guidance on AI and data protection, updated in 2023. It covers accountability, transparency, accuracy, fairness and security of AI systems. In 2026 the regulator announced plans for a statutory code of practice on AI and automated decision-making, resources to help SMEs and public bodies assess off-the-shelf AI tools, and guidance on agentic AI.

The common thread does not change: the organisation that deploys an AI tool stays responsible for the data it puts into it. The vendor does not carry that risk for you.

The pro-innovation approach versus the EU AI Act

London chose a different path from Brussels. Since the 2023 white paper on a pro-innovation approach to AI regulation, the government has asked existing regulators, such as the ICO, the FCA, the CMA and Ofcom, to apply shared principles in their sectors. As of autumn 2026, the government has not introduced a general AI bill.

The EU AI Act, by contrast, has applied in stages since February 2025. Its reach goes beyond the Union: it also covers providers outside the EU that place a system on the EU market, and providers and deployers outside the EU where the system's output is used in the Union. A UK company serving European customers can therefore be in scope, even without a subsidiary on the continent.

Three typical situations for a UK company

1. You process data about people in the EU. The EU GDPR may apply on top of the UK GDPR, especially if you offer them goods or services.

2. You build AI into a product sold in the EU. The AI Act may treat you as a provider, with obligations that depend on the risk level.

3. Your teams use AI assistants every day. This is the most common and most overlooked case: customer, HR or contract data goes into prompts daily, often with no control at all.

Good news for data flows: in December 2025 the European Commission renewed its adequacy decisions for the UK until December 2031. Transfers from the EU to the UK stay simple. But adequacy says nothing about what your staff send to an AI service hosted elsewhere.

One control for two regimes

Rather than running two separate policies, many companies look for a control that works on both sides of the Channel. That is the job of AI DLP such as ZeusLock, running on the device or in the browser:

• it detects personal and sensitive data in prompts and files before they are sent;

• it replaces that data with realistic placeholders through format-preserving anonymisation, warns the user or blocks the upload, depending on the rule you choose;

• it logs every incident, which documents the appropriate technical measures that both the UK GDPR and the EU GDPR require.

To see how a leak actually happens, read our anatomy of an AI data leak. On the EU side, our EU AI Act and GDPR compliance checklist sets out the expected controls. To put a figure on the risk, see the real cost of shadow AI.

Summary

The UK has eased parts of its data protection law with the Data (Use and Access) Act 2025 and still has no general AI law. But the UK GDPR still demands security and minimisation, the regulator is preparing an AI code, and the EU AI Act applies as soon as your systems touch the EU market. Controlling data at the source, in the prompt, remains the simplest way to satisfy both regimes.

Operating in the UK and the EU? Book a ZeusLock demo to protect your data across every AI tool your teams use.