How ICO guidance shapes AI content operations under UK GDPR

What to take away

Where ICO AI guidance sits alongside UK GDPR and the Data Protection Act 2018

The Information Commissioner's Office (ICO) regulates data protection in the UK. It enforces the UK GDPR and the Data Protection Act 2018, which together set the rules for any AI content operations that touch personal data.

The UK GDPR is the retained EU regulation as it applies domestically. The Data Protection Act 2018 supplements it, covering exemptions, enforcement powers and the ICO's remit. The Data Protection Act 2018 is the primary UK legislation you cite in your records.

ICO guidance does not create new law. It explains how the regulator expects existing principles to apply to AI systems. That matters because enforcement decisions lean on whether you followed published guidance in good faith.

The UK GDPR guidance and resources from the ICO covers the principles, individual rights and accountability duties that apply to AI content operations.

For AI specifically, the ICO's guidance on AI and data protection sets out how to apply principles such as lawfulness, fairness, transparency, data minimisation and accuracy to systems that infer from personal data.

What each instrument does in an AI content workflow

Why most content teams are already processing personal data

Most UK content teams process personal data without noticing. A client brief with a named customer, a testimonial draft, a CRM export used to shape tone, or a support transcript pasted into an online tool all count.

Once personal data is in scope, the UK GDPR applies in full. That includes the right of access, the right to erasure and the duty to report certain breaches to the ICO within 72 hours.

The ICO can act on complaints, audits and breach notifications. Penalties under UK GDPR reach up to £17.5 million or 4 per cent of global annual turnover, whichever is higher, for the most serious breaches.

Your data protection duties start with knowing what personal data enters the workflow, where it is stored and who can see it.

Choosing a lawful basis for AI content operations that process personal data

You need a lawful basis before processing begins, not after. Article 6 of UK GDPR lists six: consent, contract, legal obligation, vital interests, public task and legitimate interests.

Content operations usually rely on one of three. Contract covers processing needed to deliver a client service. Legitimate interests covers internal efficiency and quality control. Consent covers anything involving marketing to individuals.

Legitimate interests is the most common and the most scrutinised. You must run a three-part test: identify the interest, show the processing is necessary, and balance it against the individual's rights and expectations.

Record the balancing test. A one-line assertion that processing is in your legitimate interests will not satisfy the ICO if a complaint arrives.

Special category data raises the bar

Article 9 covers special category data, including health, ethnicity and sexual orientation. You need a separate condition to process it.

Content teams rarely intend to process special category data. It arrives anyway, in case studies, customer stories, HR content or user-generated comments.

If a prompt or dataset is likely to contain it, either strip it out or establish an Article 9 condition. Consent is the usual route, and it must be explicit.

Children's data

UK GDPR Article 8 sets extra conditions for information society services offered to children. If your content operations touch audience data for under-18s, you need age assurance and parental consent where applicable.

The ICO's Age Appropriate Design Code applies to services likely to be accessed by children. It sets 15 standards covering data minimisation, transparency and profiling.

Vendors and joint controllership

When you use a third-party AI tool, establish whether the vendor is a processor or a joint controller. Most are processors, which means you need an Article 28 contract.

That contract must cover processing only on your instructions, security, breach notification, sub-processors, audit rights and deletion on termination. Check the vendor's standard terms against these points rather than assuming.

If the vendor uses your data to train its own systems, it is likely acting as a controller for that purpose. That changes the analysis and may need its own lawful basis.

Your rules and ethics should state which basis applies to each processing activity, so editors know what they can and cannot do without asking.

Data minimisation and storage limits in AI content workflows

Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary. Article 5(1)(e) requires you to keep it no longer than necessary.

These two principles do most of the work in AI content operations. They also cause most of the problems.

Minimise at the point of entry

The simplest control is to stop personal data entering the workflow. Ask whether the tool needs the data at all.

A tone-of-voice pass does not need customer names. Summarising a report does not need account numbers. Drafting copy does not need full CRM records.

Where you can, use synthetic or anonymised examples. Anonymisation under UK GDPR means the data can no longer be linked to an individual by anyone, which is a high bar. Pseudonymisation, where identifiers are replaced but re-identification remains possible, still counts as personal data.

Minimise in prompts

Prompts are a common leak. Editors paste client emails, support tickets or meeting notes into an online tool to get a better draft.

Set a rule: no personal data in prompts unless the tool is approved for it and the processing is covered by your records. Provide a redaction step before paste.

If the tool retains prompts for improvement, that retention is processing. Check the setting and turn it off where possible.

Set storage limits

Define retention periods for each data type. Prompts, outputs, training sets and evaluation logs all need a stated life.

Indicative periods for a content team: prompts 30 days; tool outputs 90 days; evaluation logs 12 months; training data reviewed at 12 months and deleted if it still contains identifiers. Treat these as typical starting points and adjust them to the purpose.

Automate deletion where the vendor allows it. Where it does not, put a manual review in the calendar and record that it happened.

Accuracy and the right to rectification

Article 5(1)(d) requires accuracy. AI outputs can be confidently wrong, and if they feed into a decision about a person, that person has a right to rectification under Article 16.

Build a correction route. If a tool produces an inaccurate statement about a named individual, you need a way to fix it and to stop it recurring.

Data minimisation checklist for AI content workflows

Transparency duties and explaining decisions made with AI

Articles 13 and 14 require you to tell people what you do with their data. Article 22 restricts solely automated decisions that produce legal or similarly significant effects.

AI content operations rarely make decisions about individuals. But they can influence them, and that is enough to trigger transparency duties.

What to say in a privacy notice

Your privacy notice should name the AI tools used for processing personal data, the purposes, the lawful basis and the retention period. It should also explain any automated decision-making and the logic involved.

Generic wording about "third-party service providers" is not enough when a named AI system is doing the work. Be specific about categories of tool and what they do.

An example of wording that meets the test:

"We use [tool name] to draft marketing copy. We send it the brief and any approved background material. We do not send customer names, email addresses or account numbers. Prompts are held for 30 days and are not used to train the tool."

Explaining decisions

The ICO's guidance on explaining decisions made with AI sets out how to give meaningful information about the logic, significance and consequences of AI-assisted decisions.

In content operations, the decisions in question are often editorial: what gets published, what gets flagged, what gets personalised. If those decisions affect individuals, explain the role AI played.

Write so a non-specialist can follow it. A reader should understand what the system does, what data it uses and what they can do about it.

Human review as a safeguard

Article 22 allows solely automated decisions only in narrow circumstances. Most teams avoid the issue by keeping a human in the loop.

Human review must be meaningful. A rubber-stamp approval does not count. The reviewer needs the authority, the information and the time to change the outcome.

Document who reviews what and how disagreements are resolved. That record is what shows the safeguard is real.

Drafting the notice

A disclosure policy gives editors approved wording for privacy notices, bylines and client-facing explanations. It stops each team inventing its own version.

Running the ICO AI and data protection risk toolkit before you buy tools

The ICO publishes an AI and data protection risk toolkit to help organisations assess AI systems against data protection law.

Use it before procurement, not after. The output becomes part of your accountability record and your vendor selection evidence.

How to run it

Risk items from the toolkit that apply to most content tools include inaccurate or misleading outputs, bias or discriminatory outcomes, and a lack of transparency about how a result was reached. Name them in the assessment and say which control addresses each one.

What to do with the output

Keep the completed assessment with the procurement file. If the tool changes, or the vendor changes its terms, revisit the assessment.

Where residual risk is high, consider a DPIA. UK GDPR Article 35 requires one for processing likely to result in high risk, and the ICO lists AI-related processing among the triggers.

Procurement questions that save trouble later

Ask where data is stored and whether it leaves the UK. Transfers outside the UK need a valid mechanism under Chapter V of UK GDPR.

Ask whether the vendor uses your data for training, how long it retains prompts, and how deletion works. Get the answers in writing.

Ask about sub-processors and how you are notified of changes. Ask for the security certifications and the breach notification timeline.

Keep the paper trail

Store the assessment, the contract, the privacy notice wording and the training records together. An ICO review will ask for them as a set.

A delivery method that survives audit treats these documents as part of the workflow, not as an annual scramble.

Direct marketing, PECR and email content prepared with AI tools

PECR sits alongside UK GDPR and covers electronic marketing, cookies and similar technologies. The ICO enforces both.

The rules differ by audience. Marketing to individuals requires consent, with a limited soft opt-in for existing customers in some circumstances. Marketing to corporate subscribers has its own rules.

How the copy reaches the page does not change the legal position. The channel and the recipient determine the rules.

Consent must be specific and recorded

Consent under PECR must be freely given, specific, informed and unambiguous. A pre-ticked box does not count. Nor does a bundled acceptance of terms.

Record when and how consent was given, and what the person was told. If you cannot show it, you cannot rely on it.

The soft opt-in

The soft opt-in lets you email existing customers about similar products, if you collected their details in a sale, offered an opt-out at the time and in every message, and they have not opted out.

It is narrow. It does not cover new audiences, and it does not cover charities or non-commercial bodies in the same way.

Unsubscribe and sender identity

Every marketing message needs a valid address for opt-out requests and a clear sender identity. Opt-outs must be honoured promptly.

Speed of production is not consent. Keep the two processes separate.

Cookies and tracking pixels

PECR also governs cookies and similar tracking. Non-essential cookies need consent before they are set.

If your AI content platform drops analytics cookies on a client site, that is in scope. Check the consent mechanism before you deploy.

Which PECR rules apply to each marketing scenario

Documenting accountability so an ICO review finds the evidence

Article 5(2) makes accountability a principle. You must be able to demonstrate compliance, not just claim it.

That means records, not intentions. An ICO review will ask for documents, and a verbal account of good practice will not carry weight.

The UK regulations that apply to AI content operations are several instruments working together, so your records should show how they interact.

Records of processing

Article 30 requires records of processing activities. For AI content operations, list each tool, its purpose, the data categories, the lawful basis, retention and recipients.

Keep the record current. A stale record is worse than none, because it misleads.

DPIAs and risk assessments

Keep every DPIA and every completed risk toolkit assessment. Note the date, the owner and the outcome.

Where you decided not to do a DPIA, record why. A reasoned decision is defensible; silence is not.

Training and instructions

Show that editors have been trained on the rules. Keep attendance records, materials and the date of the last refresh.

Instructions to staff should be written and accessible. Policies that live only in someone's head are not evidence.

Breach response

Have a breach response plan with named roles and a 72-hour notification route to the ICO. Test it.

Record near misses as well as incidents. They show the process is working.

Vendor and transfer records

Keep contracts, sub-processor lists, transfer mechanism assessments and security reviews. Note review dates.

Keep the signed transfer documents with them. For a transfer outside the UK, that usually means the International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, both issued by the ICO.

Record the vendor's retention setting, the setting that controls training on your data, and the date you last checked each one.

If a sub-processor changes, update the record and repeat the relevant part of the risk toolkit before the next campaign.

An accountability checklist

Review cadence

Set a quarterly review of tools, contracts and retention. Set an annual review of the DPIA and the risk assessment.

Put the dates in the calendar and assign owners. Accountability is a habit, not a project.

Common questions

Does UK GDPR apply to AI content operations that only use public data?

It applies if the data relates to identifiable individuals, even if it was public. Public availability does not remove data protection duties.

Do I need consent to use an AI tool for internal drafting?

Not usually. Contract or legitimate interests is the more common basis for internal processing. Consent is needed when the processing is optional and the individual can refuse.

Can I use client data to train an internal system?

Only with a lawful basis, a contract that permits it, and a documented assessment. Check whether the client's own privacy notice covers this use.

What must a privacy notice say about AI?

Name the purposes, the lawful basis, the tool categories, retention and any automated decision-making. Explain the logic so a non-specialist can follow it.

Is marketing email prepared with AI tools subject to PECR?

Yes. PECR applies to the message and the recipient, not the method of writing. Consent and opt-out rules are unchanged.

How long should I keep prompts and outputs?

Only as long as necessary for the stated purpose. Set a period, document it, and delete on schedule.