AI is transforming how organisations operate, and how people access information, products and services. The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection.
From the training of underlying models to the decisions they inform, AI systems rely on personal data at every stage. And where personal data is used, data protection law applies. But only 33% of people trust companies to protect their personal data when using AI.1
Thus, the organisations that benefit most from AI will be those that build and maintain public trust by protecting their data. Getting data protection right helps organisations to invest in, develop and scale innovative technologies that people will genuinely want to use.
As the data protection regulator,
we’re here to support organisations to innovate with confidence
Four steps to prioritise data protection
- Adopt privacy by design: Build privacy, transparency and accountability into AI-powered products and services from the outset, so organisations and people understand what data is being used and how it shapes outcomes.
- Put people at the centre of AI decisions: Fairness and bias testing should be continuous, not one-off. Organisations are responsible for the impact of their systems on people at every stage of their lifecycle.
- Access support to innovate responsibly: ICO Innovation Services offer tailored support, from quick turnaround advice to longer-term regulatory sandbox analysis, helping organisations test new ideas and embed privacy into products and services.
- Stay updated: With AI evolving rapidly, organisations should stay up to date on regulatory expectations. We have a range of guidance focused on data protection compliance in AI and will continue to produce as the technology develops.
Focus on the foundations
Public confidence in AI adoption won’t happen by default. It requires organisations to take their legal obligations seriously and make privacy and security central to their development and use of AI, rather than an afterthought.
As the data protection regulator, we’re here to support organisations to innovate with confidence. But we will act where organisations fall short and put people at risk.
Data protection isn’t just a legal obligation — it’s the foundation for AI innovation that people can trust.
[1] Ipsos AI Monitor. (2025). The Ipsos AI Monitor 2025. https://tinyurl.com/mpr4v3vs.
