Artificial intelligence is rapidly reshaping how organisations operate, from automating internal processes to enhancing customer engagement and decision-making. While these technologies offer clear commercial advantages, they also raise complex legal and regulatory considerations, particularly under the UK’s data protection regime. Businesses deploying AI must strike a careful balance between innovation and compliance.

The Legal Framework

In England and Wales, the use of AI systems that process personal data is governed primarily by the UK GDPR and the Data Protection Act 2018. These laws apply regardless of the technology used and impose obligations on organisations acting as data controllers or processors.

The core principles remain central. Personal data must be:

– processed lawfully, fairly and transparently;

– collected for specified purposes;

– limited to what is necessary;

– accurate;

– retained only as long as needed; and

– kept secure.

AI systems, particularly those involving large datasets or automated decision-making, can test these principles in practice.

Key Risk Areas for AI Use

1. Lawful Basis and Transparency Organisations must identify a lawful basis for processing personal data within AI systems, such as consent, contractual necessity or legitimate interests.

Transparency obligations can be more challenging where AI operates in complex or opaque ways, making it harder to explain processing activities clearly to individuals.

2. Automated Decision-Making Under the UK GDPR, individuals have rights in relation to decisions made solely by automated means that have legal or similarly significant effects.

Businesses using AI for profiling, credit assessments, recruitment screening, or similar activities should ensure appropriate safeguards are in place, including the possibility of human intervention.

3. Data Minimisation and Purpose Limitation AI systems often rely on large volumes of data, but organisations must still ensure that only necessary data is used and that it is not repurposed in ways incompatible with the original collection purpose.

4. Bias and Fairness AI models can inadvertently perpetuate or amplify bias present in training data. This raises both legal and reputational risks, particularly in regulated sectors. Regular testing and monitoring are essential to mitigate discriminatory outcomes.

5. Security and Data Governance AI systems can introduce new vulnerabilities, especially where third-party tools or cloud-based platforms are used. Robust technical and organisational measures are required to safeguard personal data.

Regulatory Expectations

The Information Commissioner’s Office (ICO) has issued guidance on AI and data protection, emphasising accountability and risk-based approaches. In many cases, organisations will be expected to carry out a Data Protection Impact Assessment (DPIA) before deploying AI systems that present a high risk to individuals’ rights and freedoms.

Practical Steps for Businesses

To balance innovation with compliance, organisations should:

· Conduct early-stage legal and data protection assessments when considering AI adoption

· Map data flows and understand what personal data is being used and why

· Implement clear governance frameworks for AI development and deployment

· Ensure appropriate contractual protections with third-party AI providers

· Maintain clear, accessible privacy notices explaining AI use

· Regularly audit AI systems for accuracy, fairness, and security

Berry Smith Bottom Line

AI regulation continues to evolve, both in the UK and internationally. While the UK has signalled a flexible, principles-based approach to AI governance, data protection laws remain firmly in place and actively enforced. Businesses that embed compliance into their AI strategies from the outset will be better placed to innovate confidently and sustainably.

If you would like advice on compliance with data protection law, or assistance with drafting policies, please contact a member of our team on 02920 345511 or at commercial@berrysmith.com