The ICO expects an organisation running AI agents on personal data to show, not assert, that it is accountable. That means a DPIA before launch, a lawful basis for each agent's purpose, clear roles with vendors, fair and statistically sound outputs, security against AI-specific attacks, minimal data access, and individual rights that reach agent memory and logs.
What does the ICO require, in plain words?
The ICO applies UK GDPR and the Data Protection Act 2018. Its guidance on AI and data protection groups the expectations into several areas. In substance:
Accountability and governance. Senior management owns AI risk. A DPIA under Article 35 is expected for most AI processing of personal data that is likely to be high risk. Controller and processor roles are clear. Records of processing under Article 30 reflect the AI use.
Lawfulness. Each distinct purpose has a lawful basis under Article 6. Purposes are separated, so that a basis for one purpose is not stretched to cover another.
Fairness. Processing must not have unjustified adverse effects on people, and outputs must not discriminate.
Transparency. People are told how their data is used by AI, in a form they can understand.
Accuracy. Personal data must be accurate. The ICO distinguishes this from statistical accuracy, how often a system is right, and expects both to be managed.
Security. AI brings new risks, such as attacks that extract training data or manipulate inputs, which must be part of the security assessment.
Data minimisation. Systems should use only the personal data needed.
Individual rights. Rights of access, rectification, erasure and objection must work for data held by AI systems.
Who does it apply to?
Any controller or processor under UK GDPR. The ICO enforces against the organisation, not against the technology. Organisations using agents across borders face other regulators too; the UAE's federal regime is set out in UAE Personal Data Protection Law and AI agents.
What does the ICO look for when the system is an agent?
The ICO's guidance was written largely with predictive models and generative tools in mind. Agents bring four sharper issues.
Purposes multiply quietly. An agent's job grows as its brief is edited. Each new job can be a new purpose needing its own basis. The ICO will look for evidence that purposes were assessed as they changed, not only at launch. Our article on what lawful basis an AI agent needs to process personal data covers the per-purpose analysis.
Data reaches more parties. Agents call model providers, search services and tools. Each recipient must be identified, contracted and, if abroad, covered by a transfer mechanism. See whether personal data can be sent to a model provider in another country.
Security now includes manipulation. An agent that reads emails and documents can be steered by instructions hidden inside them. That is a security risk to personal data, because a manipulated agent can disclose it.
Rights must reach new stores. Agent memory, conversation history, summaries and logs all hold personal data. An access or erasure request that misses them is incomplete.
How do you meet the ICO's expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Accountability | Named senior owner; agents in governance reporting | Board papers; owner register |
| DPIA | Assessment per agent before launch, updated on change | DPIA records with review dates |
| Controller and processor roles | Contracts with platform and model provider; sub-processor list | Signed contracts; list |
| Lawful basis per purpose | Each agent capability mapped to a purpose and basis | Records of processing |
| Fairness | Outcome testing across groups for agents affecting people | Test results |
| Transparency | Privacy information describes each agent job | Notice versions |
| Accuracy | Agents read current data from systems of record; statistical accuracy tested per capability | Source configuration; test results |
| Security | Threat assessment includes manipulation of agent inputs; provenance controls | Threat model; test reports |
| Minimisation | Field-level access per capability | Access maps |
| Rights | Requests searched across memory, history, summaries and logs | Request files |
| Automated decisions | Safeguards where agents decide alone | Decision records |
Automated decisions are a large subject in their own right; see ICO and automated decision-making by AI agents.
What will the ICO ask?
- Show us the DPIA for this agent. When was it last reviewed against what the agent now does?
- What purposes does the agent serve, and what is the basis for each?
- Who receives personal data when the agent runs, and where are they?
- How have you tested the agent for unfair outcomes?
- How would you know if someone manipulated the agent into disclosing data?
- Walk us through an access request: which agent stores did you search?
What does the ICO not cover?
The ICO does not regulate the commercial quality of agents, financial conduct or product safety. It does not certify agents or platforms. Sector regulators such as the FCA apply their own rules to the same agents. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Two ICO concerns, manipulation and minimisation, are handled at the platform. Pryme's Context Protocol stamps every fact with its provenance, so instructions arriving in an external document carry the weakest class and cannot authorise an action. Sources are named per capability in the agent's brief, and the minimum chain checks them on every action.
Questions people ask
Does the ICO expect a DPIA for every agent?
Not automatically, but most agents that process personal data in new ways, at scale or to make decisions about people meet the high-risk threshold. If you decide a DPIA is not needed, record why.
Is statistical accuracy a legal requirement?
The accuracy principle concerns the personal data itself. The ICO also expects AI systems to be sufficiently statistically accurate for their purpose, as part of fairness. In practice you need to test and document both.
Does the ICO allow using customer conversations to improve agents?
It can be lawful if it is a compatible purpose, people are told, and data is minimised. Using conversations to improve a vendor's products for other customers raises harder questions about roles and basis.