Key findings

• Do not assume an AI model or embedding store is anonymous.

• Treat prompts, outputs, memory, and observability data as potential personal data.

• Separate UK, EU, and US analyses; similar controls can support different legal duties.

• Review automated decisions, profiling, sensitive data, children, workers, and consequential uses early.

• Track effective dates and regulator updates because this area is changing rapidly.

Begin with a complete AI data map

Document each source of personal data, including user prompts, uploaded files, CRM or HR records, retrieved documents, public data, inferred attributes, model outputs, feedback, memory, embeddings, tool results, and telemetry. For every flow, record purpose, categories, people, source, recipient, vendor role, location, retention, access, security, and deletion. Include testing and support environments, which are often overlooked.

Decide whether each field is necessary for the workflow. Redact, tokenize, aggregate, or exclude where possible. Do not call a system anonymous merely because names were removed. The EDPB's opinion on AI models says anonymity requires assessment of whether people can be identified and whether personal data can be extracted from the model, evaluated case by case. Pseudonymous data remains personal data.

Apply the UK data-protection framework

UK GDPR and the Data Protection Act 2018 continue to govern personal data, as amended by the Data (Use and Access) Act 2025. Apply lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability. Identify controller and processor roles, choose and document a lawful basis, address special-category and criminal-offence data separately, update notices, honor rights, and control international transfers.

The DUAA is now in force and replaced the previous Article 22 structure with Articles 22A-D. It permits significant solely automated decisions using non-special-category data in wider circumstances, but requires safeguards including information, a way to make representations and challenge the decision, and human intervention. Restrictions remain stronger for special-category data. ICO automated-decision guidance was still being updated in July 2026, so check the final guidance and specific commencement position for the use case.

Apply EU GDPR and the AI Act separately

EU GDPR requires a lawful basis, transparent and fair processing, minimization, security, rights handling, and DPIAs for processing likely to create high risk. Article 22 governs solely automated decisions with legal or similarly significant effects, subject to limited conditions and safeguards. Legitimate interests require a purpose, necessity, and balancing assessment; they are not a default permission for model development or deployment.

The EU AI Act is a separate product and use regulation that does not replace GDPR. As of 30 July 2026, prohibited-practice and AI-literacy rules have applied since February 2025, and general-purpose AI obligations since August 2025. The Commission's current implementation pages should be checked for the amended high-risk timetable and applicable transition. Classify whether the business is provider, deployer, importer, or distributor and whether the use is prohibited, high-risk, transparency-regulated, or lower-risk.

Navigate the US federal and state patchwork

The United States does not operate one GDPR-equivalent federal framework across all private-sector AI processing. Analyze the FTC Act, sector laws and rules such as health, financial, credit-reporting, communications, and children's privacy requirements, anti-discrimination law, contract promises, and state comprehensive privacy and AI laws. The FTC emphasizes that companies must honor privacy promises and maintain security appropriate to the data.

State scope and thresholds differ. California's finalized regulations took effect on 1 January 2026, with risk-assessment compliance beginning in 2026 and ADMT-specific compliance beginning 1 January 2027 for covered businesses and uses. Colorado replaced its earlier AI law with an Automated Decision-Making Technology law effective 1 January 2027 and was conducting rulemaking in July 2026. Track states where customers, employees, and operations are located rather than relying only on headquarters.

Control vendors, model providers, and transfers

Identify every model host, cloud service, vector database, automation platform, observability provider, support tool, and subprocessor. Confirm whether each acts as processor, service provider, contractor, independent controller, or another role under applicable law. Contract for documented instructions, confidentiality, security, subprocessors, assistance with rights and assessments, incident notification, return and deletion, audits or evidence, and limits on training or unrelated use.

Map international transfers independently from hosting labels. For UK and EU data, use an applicable adequacy route or transfer safeguards and assess supplementary measures where required. Verify actual region support for every feature, including logs and human support. In the US, include state contractual restrictions. Product settings and marketing claims do not replace a binding data-processing agreement.

Run a DPIA or risk assessment before launch

A DPIA should describe processing, purpose, necessity and proportionality, risks to people, and measures that reduce those risks. Complete it early enough to change the design. High-risk indicators include innovative technology combined with profiling, large-scale sensitive data, systematic monitoring, children or vulnerable people, matching data sets, and significant automated decisions. EU and UK requirements differ in detail after UK reform, so use the applicable regulator's current guidance.

In the US, state laws may require risk assessments for covered processing, including some profiling or ADMT. One evidence pack can support multiple regimes, but do not assume it satisfies all of them. Record jurisdiction, legal basis or permission, notices, rights, retention, vendor controls, testing, human review, discrimination risk, security, residual risk, approval, and review triggers.

Design privacy into the workflow

Use field-level allowlists, purpose-specific retrieval, tenant isolation, role-based access, short retention, controlled memory, encrypted storage and transport, and redacted telemetry. Keep production data out of development unless approved and necessary. Separate user content from evaluation sets and maintain deletion links across source, index, cache, memory, log, and backup layers where technically and legally required.

Explain AI use in clear language: what data is used, source, purpose, recipients, important consequences, rights, and how to contact the business. Do not overstate model accuracy or human oversight. Provide correction and challenge routes that reach someone with authority. Test access, deletion, objection, opt-out, and human-review processes end to end; a policy without an operational path is not effective.

Use a launch and monitoring checklist

Before launch, confirm scope by jurisdiction; data map; purpose and lawful basis; sensitive-data conditions; notices; DPIA or state assessment; automated-decision safeguards; vendor and transfer terms; security; retention and deletion; rights handling; evaluation; incident response; and accountable approval. If a required condition is unresolved, reduce scope, remove data, add review, delay, or stop.

After launch, monitor data drift, new inferences, access, vendor and subprocessor changes, model updates, complaints, rights requests, serious errors, bias, security events, and changes in law. Review this guide's dated status: official sources current to 30 July 2026 were used, but implementation timetables and regulator guidance can change. Obtain qualified advice for consequential employment, credit, health, insurance, education, children's, biometric, or multi-state uses.

Sources and methodology

This article synthesizes the primary sources below as of the publication date. Forecasts and recommendations are directional scenarios, not guarantees; they should be tested against your workflow, data, risk tolerance, and current vendor documentation.

UK Information Commissioner's Office: AI and data protection risk toolkit (accessed 2026-07-30)

UK Department for Science, Innovation and Technology: Data Use and Access Act 2025 privacy changes (accessed 2026-07-30)

European Data Protection Board: EDPB Opinion 28/2024 on AI models (accessed 2026-07-30)

European Union: EU Artificial Intelligence Act (accessed 2026-07-30)

European Commission: Navigating the AI Act (accessed 2026-07-30)

US Federal Trade Commission: FTC Privacy and Security guidance (accessed 2026-07-30)

California Privacy Protection Agency: California CCPA and ADMT regulations (accessed 2026-07-30)

Colorado Attorney General: Colorado Automated Decision-Making Technology rulemaking (accessed 2026-07-30)