UK GDPR and the Data Protection Act 2018 apply in full whenever an AI agent processes personal data. The deploying firm is the controller: it needs a lawful basis, must follow the Article 5 principles, respect rights, assess high-risk processing and contract with its model provider. The UK differs from the EU on automated decisions, transfers and having no AI Act.
What does the UK regime require, in plain words?
UK GDPR, read with the Data Protection Act 2018, is the UK's general data protection law, enforced by the ICO. Its core obligations for controllers, in substance:
- Principles (Article 5): lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability for showing all of these.
- Lawful basis (Article 6): each processing purpose needs one, such as contract, legal obligation or legitimate interests. Special category data, such as health information, needs an additional condition.
- Rights: information, access, rectification, erasure, restriction, objection, and protections around significant automated decisions.
- Automated decisions (Article 22): safeguards for decisions with legal or similarly significant effects made without meaningful human involvement. UK law in this area has been amended to widen when such decisions can be made, while keeping the safeguards and tighter limits for special category data; check which provisions are in force for you.
- Records and assessments: records of processing (Article 30) and a data protection impact assessment for high-risk processing (Article 35).
- Processors and transfers: contracts with processors; transfers outside the UK under the UK's own adequacy decisions and transfer tools.
- Security and breaches: appropriate security, and notification of qualifying breaches to the ICO and, where high risk, to affected people.
Who does it apply to?
Controllers and processors established in the UK, and those outside the UK offering goods or services to, or monitoring, people in the UK. The firm that decides why and how the agent processes data is the controller; agent platforms and model providers acting on its instructions are usually processors.
What does UK GDPR mean when the system is an agent?
Each capability needs a purpose and a basis. An agent that answers a balance query, flags possible fraud and suggests products is doing three things. Each needs its own lawful basis, and the agent should be unable to use data beyond the purposes recorded.
Minimisation applies to retrieval. An agent that loads a customer's whole history to answer one question processes more than the purpose needs. Scope what it can see.
Accuracy applies to what it writes. An agent that updates records on the strength of a misread email breaches accuracy and spreads the error. Record changes should rest on reliable sources.
Transparency includes telling people an agent is involved. Privacy information should explain the agent's role in terms customers can follow, and the ICO expects organisations using AI to be able to explain decisions it contributes to.
Automated decisions need real review or real safeguards. Where an agent decides with significant effect, either a person meaningfully reviews it, or the Article 22 safeguards apply. Our piece on UK GDPR Article 22 and agents covers this in depth.
Most agent deployments call for a DPIA. New technology, decisions about people and processing at scale point that way; see a UK GDPR DPIA for agents.
The model provider is a processor. Contract terms must bind it to your instructions, security and deletion, and restrict its own use of your data. If it processes outside the UK, you need a transfer mechanism.
Take an illustrative case. A UK energy supplier's agent handles payment plan requests. Its records of processing list three capabilities with their bases: contract for setting up plans, legal obligation for affordability checks required by its regulator, and legitimate interests for service analytics. The agent sees only billing and payment fields. A DPIA identifies vulnerable customers as the main risk, so the agent hands any mention of hardship or illness to a person. The model provider contract restricts use of data and covers its processing abroad.
How do you meet UK GDPR for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful basis per purpose | Each capability mapped to a basis | Records of processing |
| Purpose limitation | Agent blocked from uses outside recorded purposes | Capability configuration; refused actions |
| Minimisation | Retrieval scoped to fields the task needs | Data map |
| Accuracy | Changes rest on reliable sources, recorded | Change log with sources |
| Transparency | Privacy information explains agent use | Published notice |
| Automated decisions | Meaningful review or Article 22 safeguards | Review records; safeguard records |
| DPIA | Assessment before deployment, updated on change | Signed DPIA |
| Processor contracts | Model provider and platform bound by contract | Contracts |
| Transfers | UK transfer mechanism for processing abroad | Transfer risk assessments |
| Security and breaches | Least privilege; agent incidents in breach process | Security records; breach log |
What will the ICO ask?
- What personal data does each agent process, for which purposes, on which basis?
- Which agent decisions have significant effects, and who reviews them?
- Did you complete a DPIA, and what did it change?
- What does your model provider do with the data, and where?
- How would you explain an agent's decision to the person affected?
What does UK GDPR not cover?
It does not regulate AI as such; the UK has no AI Act. Conduct, prudential and resilience rules from the FCA and PRA apply alongside for financial firms. And firms operating in both markets face two regimes that have started to diverge; see how AI rules differ between the UK and EU. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is the agent platform a controller or a processor?
Usually a processor, acting on the deploying firm's instructions. It becomes a controller for any purposes it decides for itself, such as using your data to improve its own products, which your contract should restrict.
Do prompts sent to a model provider count as a transfer?
If the provider processes the data outside the UK, yes. You need a valid UK transfer mechanism, and you should know where processing happens.
Does UK GDPR require customers to be told they are dealing with an agent?
Transparency requires telling people how their data is processed, which in practice includes explaining that an AI agent handles their request. Consumer protection and conduct rules point the same way.