AI and privacy

In short

AI and privacy is the question of how personal-information rules apply when an AI system collects, learns from, or produces information about an identifiable person. It covers training, testing, deployment and predictions, and the controls people have over those uses.

Also called: AI privacy, Privacy in artificial intelligence
Topic: Safety, ethics and risk
Level: Beginner

In the UK, data protection law covers information about an identified or identifiable person. Where an AI system uses that information, the Information Commissioner's Office says the law can apply to training, testing and deployment, and that a prediction or inference about a person is itself personal data. A system that does not use personal data falls outside that law. Weather forecasting is the example the Office gives. The page that says this also says the guidance is under review because of the Data (Use and Access) Act.¹

The risk is not only a leaked file. NIST says AI creates new re-identification risks, that its predictions could reveal greater insights about people, and that it could amplify behavioural tracking and surveillance.² The Office's separate AI guidance is organised around lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security. It is advice on the law, not a statutory code, and it carries the same Data (Use and Access) Act review notice.³

Privacy here is not the same duty as locking a system against outsiders. The Office lists security as one principle beside purpose limitation, data minimisation and storage limitation.³ NIST's Privacy Framework is a voluntary tool for managing privacy risk across an organisation. NIST says that document does not have the force of law and is not meant to bind the public.⁴

Some decisions bring extra controls. In draft guidance updated on 31 March 2026, the Office says Article 22C of the UK GDPR applies to significant decisions made solely by automated processing. The safeguards it quotes are information about the decision, a way to make representations, human intervention, and a way to contest the decision. The Office says this draft reflects the Data (Use and Access) Act.⁵

Example

The same draft uses a loan. It says a person may need to know what data was processed, what period it covered, what the system decided and which risk factors it identified before they can challenge the result.⁵

Why it matters

NIST says AI creates new re-identification risks, and that its predictions could reveal greater insights about people and amplify behavioural tracking and surveillance.²

Questions people ask

Does privacy law apply to AI training?

It can. The Information Commissioner's Office says UK data protection law applies where personal data is used to train, test or deploy an AI system. If the system uses no personal data, that guidance says the law does not apply. The Office says the guidance is under review after the Data (Use and Access) Act.¹

Is AI privacy the same as data security?

No. The Office's AI guidance treats security as one principle, alongside purpose limitation, data minimisation, accuracy and storage limitation. Keeping outsiders out of a system does not settle those other principles. The guidance is not itself a statute.³

Can I challenge an AI decision about me?

Sometimes. For a significant decision made solely by automated processing, the Office's March 2026 draft says UK GDPR Article 22C requires information about the decision, a way to make representations, human intervention and a way to contest it. That draft does not cover every AI output.⁵

Related terms

Sources

Back to the glossary