UK GDPR, the ICO and automated decisions
Personal data in prompts, retrieval indexes and fine-tuning sets is still personal data. The ICO's guidance on AI and data protection expects a lawful basis, a DPIA for high-risk uses, data minimization and explanations people can understand. We strip or pseudonymize identifiers before indexing, set retention on logs and make sure deleted records also leave the vector database.
UK GDPR restricts significant decisions based solely on automated processing. The Data (Use and Access) Act 2025 reshaped these rules but kept safeguards, such as telling people about the decision and letting them contest it and obtain human review. For credit, hiring or insurance use cases we design a human review step and an explanation screen from the start. This is general information, not legal advice.
