The UK has no general AI statute. AI is regulated through existing law, and for personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. that means the UK GDPR and DPA 2018 apply at every stage of the lifecycle: collecting training data, training, deploying and using outputs. The questions are familiar. Applying them to models is what is new.
Training
- Lawful basis. Training a model on personal data needs a basis for that purpose. Legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights. is the usual candidate, which means a real assessment: necessity, and people’s reasonable expectations about their data being used to train models.
- Purpose. Training is a new purpose for data collected for something else. Run the compatibility test or find a fresh basis.
- Special category data. Training data scraped or collected at scale often contains it. You need a condition, or you need to remove it.
- Research. The DUAA 2025 confirmed that commercial research can be scientific research, which can support some development work under the research provisions with safeguards.
Transparency
Tell people their data is used for training, in the privacy notice and at collection. Where data comes from elsewhere, Article 14 applies, and disproportionate effort is not a blanket answer for web-scale collection.
Accuracy and fairness
Accuracy applies to personal data the model produces about people: a generated statement about a real person is personal data and must be accurate. Statistical accuracy and bias are fairness questions. Test outputs across groups and record the results in the DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people..
Rights
Rights apply to personal data in training sets and, where it can be extracted, in models. Access, rectification and erasure against a model are hard but not optional. Design for them: keep training data traceable, and prefer approaches that allow removal or suppression.
Decisions
Where AI makes significant decisions about people without meaningful human involvement, Articles 22A to 22D apply from 2026-02-05: people must be told, and must be able to make representations, obtain human intervention and contest the decision. A human who rubber-stamps the output is not meaningful involvement.
DPIA
Developing or deploying AI that processes personal data at scale is high-risk processing. A DPIA is the place to record the basis, the fairness testing and the safeguards.
Governance
Name an owner for each model, keep a model inventory alongside the record of processing, and review models when their training data, purpose or performance changes.