Data protection and conduct rules mostly point the same way for AI agents in UK financial services: be transparent, be fair, keep records, let people challenge outcomes. They pull apart in three places: spotting vulnerability means handling health data, testing outcomes across groups means processing characteristics, and FCA record-keeping meets storage limits. Each needs a documented reconciliation.
What do the two sets of rules require?
UK GDPR and the Data Protection Act 2018, enforced by the ICO, govern how personal data is processed: lawful basis, the Article 5 principles of fairness, transparency, minimisation, accuracy and storage limitation, rights including safeguards on significant automated decisions, impact assessments for high-risk processing and security. Our overview of what the UK GDPR regime requires of agents sets these out.
The FCA's rules govern how firms treat customers and run their business. For agents, the most relevant are:
- the Consumer Duty, which requires good outcomes for retail customers across communications, products, value and support, with particular attention to customers in vulnerable circumstances, and expects firms to monitor outcomes;
- the Senior Managers and Certification Regime, which makes named individuals accountable;
- complaints handling rules, requiring fair, prompt resolution;
- record-keeping duties for business conducted.
Who does this apply to?
UK firms authorised by the FCA that process personal data, which covers banks, lenders, insurers, investment firms and payment firms. Where the PRA also supervises the firm, prudential expectations sit on top. For how the FCA views agents generally, see how the FCA views AI agents.
Where do the rules reinforce each other?
Transparency. UK GDPR requires people to be told how their data is processed. The Consumer Duty requires communications customers can understand. An agent that tells customers plainly what it is, what it does and how to reach a person meets both.
Fairness. UK GDPR's fairness principle and the Consumer Duty's outcome focus both condemn an agent that treats some customers worse without justification.
Challenge. UK GDPR gives safeguards against significant automated decisions; complaints rules give a route to redress. One clear path from an agent's action to a person who can change it serves both. See UK GDPR Article 22 and agents.
Accountability. UK GDPR requires controllers to show compliance; SM&CR requires named individuals to answer for their areas. A single record of who approved each agent's authority, and on what evidence, supports both.
Where do they pull in different directions?
Vulnerability and health data. The Consumer Duty expects firms to identify and respond to customers in vulnerable circumstances. An agent that notices a customer mention illness or bereavement is collecting information that may be special category data under UK GDPR, which needs an additional condition beyond a lawful basis. The Data Protection Act 2018 contains conditions that can support this kind of processing, but the firm must identify the right one, document it and keep use to what the purpose needs. The safest agent design records the need for support and routes the customer to a person, rather than building a profile.
Outcome testing across groups. The Consumer Duty expects firms to check that different groups of customers get good outcomes. That can mean processing data about characteristics to measure differences. Minimisation and purpose limitation still apply: use the least data needed, separate analysis from operations, and record the basis.
Record-keeping versus storage limitation. FCA record-keeping duties require firms to keep records of business conducted. UK GDPR requires personal data not be kept longer than necessary. The reconciliation is that retention for a regulatory duty is necessary, so keep agent records for the required period on a legal obligation basis, then delete. What does not reconcile is keeping everything indefinitely in case it is useful.
Take an illustrative case. A UK credit card provider's agent handles payment queries. A customer says they have just been diagnosed with a serious illness and cannot pay this month. Under the firm's design, the agent responds with care, offers to pass them to a specialist team, and records a support flag rather than the diagnosis itself. The firm's DPIA documents the condition relied on for this processing. A specialist follows up the same day. The outcome monitoring team later checks, using aggregated data, that customers with support flags receive appropriate forbearance.
How do you meet both sets of rules for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Transparency and consumer understanding | Customers told an agent is acting; plain explanation of what it does | Notices; communication testing |
| Fairness and good outcomes | Outcome monitoring across groups using minimised data | Outcome reports; basis record |
| Vulnerable customers and special category data | Agent routes signs of vulnerability to people; condition documented | Escalation records; DPIA |
| Challenge and redress | One route from agent action to a person who can change it | Complaint and review records |
| Accountability | Named senior manager approves agent authority | Responsibilities map; approvals |
| Records and storage limitation | Retention set to regulatory periods, then deletion | Retention schedule; deletion logs |
| Impact assessment | DPIA that also records Consumer Duty risks | Combined assessment |
What will the FCA or ICO ask?
- How does the agent identify and respond to vulnerable customers, and what data does it keep?
- How do you monitor outcomes across customer groups without excessive data use?
- How long do you keep agent records, and on what basis?
- Who is accountable for this agent's outcomes?
- How does a customer challenge something the agent did?
What do the two regimes not cover together?
They do not address model risk or operational resilience, which come from the PRA and other FCA rules. They do not apply EU rules to UK firms serving EU customers; for that divergence, see how AI rules differ between the UK and EU. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Can an agent record that a customer is vulnerable?
Yes, with care. Record what the firm needs to support the customer, document the lawful basis and any special category condition, and avoid storing more detail than the purpose requires.
Does the Consumer Duty override UK GDPR?
No. Both apply. The Duty may create reasons to process certain data, but processing must still meet UK GDPR's requirements.
Should the DPIA cover conduct risks too?
It is efficient to assess both together. The same agent features, such as automated decisions and handling vulnerable customers, create both data protection and conduct risks.