The ICO's AI guidance hub: where UK data protection law meets staff using chatbots
Summary of Information Commissioner's Office, Hub page, no single dateSource read
The regulator keeps its AI and data protection guidance on one hub. The practical point for a small firm is that putting customer or staff personal data into an AI tool is processing under UK GDPR, so the rules apply the moment someone pastes a client file into a chatbot.
- UK GDPR
- applies when personal data goes into an AI tool
- 1 hub
- the ICO's central page for AI guidance
- Personal data
- is the trigger, whether it is typed or pasted in
What it means for a small firm
A one-page staff policy covering what may and may not be pasted into a tool removes most of the exposure. We write that with the owner, in plain English.
Original source
Artificial intelligence (guidance hub)
Information Commissioner's Office
This page is our own summary, written 23 October 2026. The figures belong to the publisher. We checked them against the publisher’s page on the date above.
More on risk and rules
- Department for Science, Innovation and TechnologyThe UK government's AI Opportunities Action Plan: 50 recommendations, and what they mean for small firms
- Information Commissioner's OfficeAutomated decisions: the ICO consulted on new rules after the Data (Use and Access) Act
- Legal FuturesThe solicitors' regulator on AI: you cannot hand accountability to the tool or the vendor