# ICO Guidance on AI and data protection: Guidance on AI and data protection (ICO)

Source: https://www.bankingnewsai.com/ai-regulation/documents/ico-guidance-ai-data-protection
Last updated: Oct 5, 2026

The ICO's Guidance on AI and data protection explains how UK GDPR data protection principles apply to AI systems. The version on the ICO website was last updated on 15 March 2023, and the page now carries a notice that, due to changes made by the Data (Use and Access) Act, the guidance is under review and may be subject to change. It covers accountability and governance, transparency, lawfulness, accuracy and statistical accuracy, fairness, security and data minimisation, and individual rights, with a risk toolkit. The ICO is separately updating its automated decision-making and profiling guidance for the Act, with a consultation held from 31 March to 29 May 2026 and final guidance listed as expected in winter 2026.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) |
| Type | Guidance |
| Status | In force |
| Published | Mar 15, 2023 |
| Applies to | Any organisation using AI systems that process personal data, including UK banks, insurers and fintechs. The guidance is the Information Commissioner's explanation of how UK GDPR principles apply to AI; it is guidance, not law. |
| Official text | https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ |

## Key points

- The guidance is organised into sections on accountability and governance; transparency; lawfulness; accuracy and statistical accuracy; fairness; security and data minimisation; and individual rights, with an Annex A on fairness in the AI lifecycle, an AI and data protection risk toolkit and a glossary.
- The guidance page states that it was updated on 15 March 2023 and that, due to changes made by the Data (Use and Access) Act, it is under review and may be subject to change.
- Fairness section: it includes a discussion of the impact of Article 22 of the UK GDPR, which section 80 of the Data (Use and Access) Act 2025 replaced with Articles 22A to 22D from 5 February 2026.
- ADM guidance update: the ICO's draft guidance on automated decision-making, including profiling, was open for consultation from 31 March 2026 to 29 May 2026 and is listed as at drafting stage with final publication expected in winter 2026.
- Further planned AI guidance: the ICO's plans page lists guidance on foundation models, targeted for autumn 2026, and agentic AI guidance, scheduled for public consultation from September 2026 with final publication in autumn 2026.
- The guidance is not law: it does not create obligations beyond the UK GDPR and the Data Protection Act 2018, which the Information Commissioner enforces.
- The government's February 2024 response to the AI white paper highlighted the ICO's updated guidance on data protection and AI as an example of regulators implementing the AI principles.

## What changed for banks

The guidance gave banks a regulator-written reference for applying data protection law to AI, covering fairness, explainability and individual rights that sit alongside PRA and FCA expectations. The Data (Use and Access) Act 2025 has made parts of it out of date, most obviously on Article 22, so banks should treat it as a continuing source for the principles but check the ICO's updated automated decision-making guidance and notices on the page for changes.

## Use cases it governs

- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)

## What does the ICO guidance on AI and data protection require of banks using AI?

The ICO's Guidance on AI and data protection, last updated on 15 March 2023, does not create new legal duties but sets out how the UK GDPR applies to AI systems that process personal data, including those used by banks. It covers accountability and governance, transparency, lawfulness, accuracy and statistical accuracy, fairness, security and data minimisation, and individual rights, and includes an AI and data protection risk toolkit. The ICO's page states the guidance is under review because of changes made by the Data (Use and Access) Act and may change. The ICO has consulted on updated guidance on automated decision-making and profiling (31 March to 29 May 2026) and lists final publication for winter 2026, so banks should read the guidance with the Act's Articles 22A to 22D in mind.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Guidance section — accountability and governance | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) | The ICO expects organisations to be able to show how AI systems comply with data protection law, including through data protection impact assessments and clear roles. | Guidance updated 15 Mar 2023 | [ICO Guidance on AI and data protection](https://www.bankingnewsai.com/ai-regulation/documents/ico-guidance-ai-data-protection) |
| Guidance section — transparency | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) | Organisations should be transparent with individuals about AI use and explain decisions made with AI. | Guidance updated 15 Mar 2023 | [ICO Guidance on AI and data protection](https://www.bankingnewsai.com/ai-regulation/documents/ico-guidance-ai-data-protection) |
| Guidance section — lawfulness | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) | AI processing needs a lawful basis and compliance with the other UK GDPR principles at each stage of development and deployment. | Guidance updated 15 Mar 2023 | [ICO Guidance on AI and data protection](https://www.bankingnewsai.com/ai-regulation/documents/ico-guidance-ai-data-protection) |
| Guidance section — fairness (including Article 22) | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) | Organisations should address bias and discrimination in AI systems; the section's discussion of Article 22 predates its replacement by Articles 22A to 22D. | Under review since the Act | [Data (Use and Access) Act 2025](https://www.bankingnewsai.com/ai-regulation/documents/uk-data-use-and-access-act-2025) |
| Guidance section — individual rights | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) | Organisations need processes for individuals to exercise UK GDPR rights over AI systems and their outputs. | Guidance updated 15 Mar 2023 | [ICO Guidance on AI and data protection](https://www.bankingnewsai.com/ai-regulation/documents/ico-guidance-ai-data-protection) |
| Draft ICO guidance on automated decision-making including profiling | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) | Consultation on updated guidance following the Data (Use and Access) Act ran from 31 March to 29 May 2026; final guidance is listed as expected in winter 2026. | Consultation closed 29 May 2026 | [official text](https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/03/ico-consultation-on-the-draft-guidance-about-automated-decision-making-including-profiling/) |

The ICO guidance is the data-protection counterpart to the PRA's model-risk standard and the FCA's Consumer Duty. The PRA's SS1/23 governs how models are built and validated, the Consumer Duty governs customer outcomes, and the ICO guidance governs the lawful, fair and transparent use of personal data in AI. A bank's AI governance usually needs to evidence all three.

The guidance predates the Data (Use and Access) Act 2025, which replaced Article 22 of the UK GDPR with Articles 22A to 22D from 5 February 2026. The ICO's page now says the guidance is under review, and its plans page lists updated automated decision-making guidance for winter 2026, foundation model guidance for autumn 2026 and agentic AI guidance, with a consultation scheduled from September 2026.

The guidance is not law; the legal obligations are those of the UK GDPR and the Data Protection Act 2018.

### What this means in practice

- Use the ICO guidance as the structure for data protection impact assessments of AI systems, and record how each section was addressed.
- Do not rely on the guidance's Article 22 discussion for decisions taken on or after 5 February 2026; use the Act's Articles 22A to 22D and the ICO's updated ADM guidance when it is final.
- Test AI systems for statistical accuracy and bias, which the ICO treats as data protection questions as well as model-risk ones.
- Be ready to explain AI decisions to individuals and to handle rights requests that cover AI outputs.
- Track the ICO's plans page for the ADM, foundation model and agentic AI guidance releases.

## FAQ

### Is the ICO guidance on AI and data protection legally binding?

No. It is the Information Commissioner's guidance on how the UK GDPR and the Data Protection Act 2018 apply to AI. The legal obligations come from those laws, which the Information Commissioner enforces.

### Does the ICO AI guidance apply to banks?

Yes, to any organisation using AI to process personal data, including banks. Banks also have PRA and FCA expectations for the same systems, which apply on top of data protection law.

### Is the ICO AI guidance being updated after the Data (Use and Access) Act?

The page says the guidance is under review because of changes made by the Data (Use and Access) Act and may change. The ICO's updated automated decision-making and profiling guidance, consulted on from 31 March to 29 May 2026, is listed as expected in winter 2026.

### When was the ICO AI guidance last updated?

The guidance page states it was updated on 15 March 2023. The ICO has since added a notice that it is under review due to the Data (Use and Access) Act.

## Related documents

- [Bailey: Frontier AI and the Question of Governance (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-bailey-frontier-ai-governance-2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)
- [HM Treasury Financial Services AI Adoption Plan (Jul 2026)](https://www.bankingnewsai.com/ai-regulation/documents/hmt-financial-services-ai-adoption-plan-2026) — Financial Services AI Adoption Plan (Jul 14, 2026)
- [2026 BoE/FCA AI survey](https://www.bankingnewsai.com/ai-regulation/documents/uk-ai-in-financial-services-survey-2026) — The Bank of England and FCA's 2026 AI Survey (Jun 5, 2026)
- [BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/uk-joint-statement-frontier-ai-cyber-resilience-2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026)
- [BoE response to Treasury Committee AI inquiry (Apr 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-pra-response-tsc-ai-inquiry-2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026)
- [BoE/PRA plan for safe AI innovation (Apr 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-pra-safe-ai-innovation-plan-letter-2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026)
- [DSIT/DBT strategic letters to regulators (Jan 2026)](https://www.bankingnewsai.com/ai-regulation/documents/gov-uk-dsit-dbt-safe-ai-innovation-letter-2026) — How will regulators enable safe AI-powered innovation: joint letter from DSIT Secretary of State and DBT Secretary of State (Jan 28, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/ico-guidance-ai-data-protection
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.