AI tools now sit inside everyday life in the UK. You ask a chatbot for help, you upload a photo to an editing app, and you let an assistant draft an email. Each of those actions involves your personal data. This guide explains AI and GDPR in plain English: what UK law gives you, what changed in 2026, and what to check before you use an AI tool.
The short answer is this. UK GDPR still protects you when AI processes your personal data. You have the right to know what a company collects, to ask for a copy of it, to correct mistakes, and to object in some cases. A 2025 law, the Data (Use and Access) Act, changed the rules on automated decisions from 5 February 2026, so the old Article 22 wording no longer tells the full story. The safeguards that matter most, human review and the right to challenge a decision, are still there.
This article is general information, not legal advice. If a decision affects your job, your money, or your legal rights, speak to a qualified adviser.
What GDPR means when AI is involved
GDPR is the UK law that controls how organisations use personal data. Personal data means any information that identifies you, directly or indirectly. Your name and email address count. So do your photos, your voice recordings, your location, and the prompts you type into a chatbot when they can be linked back to you.
When you use an AI tool, two roles matter. The company that decides why and how your data is used is the controller. A company that only processes data on the controller’s instructions is a processor. In practice, the AI company is usually the controller for your account data and your prompts, so it carries the main legal duties.
AI adds one extra layer. Many tools do more than store your data. They analyse it, learn patterns from it, and use it to shape answers for other people. That is why the privacy notice matters more with AI than with a simple website form. Always check what a tool says about training. Some tools train their models on user content by default, and some let you opt out in settings.
Your main rights as a UK user
UK GDPR gives you several rights. These are the ones that matter most for everyday AI use.
The right to be informed
A company must tell you what it collects, why it collects it, how long it keeps it, and who it shares it with. Look for this in the privacy notice before you sign up. If an AI tool cannot explain in plain language what happens to your prompts, treat that as a warning sign.
The right of access
You can ask for a copy of the personal data a company holds about you. This is called a subject access request. Most large AI companies offer a data export in account settings, which is faster than a formal request. Use it to check what chats, uploads, and account details are stored.
The right to rectification and erasure
If your data is wrong, you can ask for it to be corrected. In some cases you can ask for it to be deleted. Deletion has limits with AI. A company can delete your chats from your account, but removing data that is already baked into a trained model is a different technical problem. Ask what deletion actually covers before you assume everything is gone. Our guide to how to delete ChatGPT chat history shows how one major tool handles this in practice.
The right to object and restrict
You can object to processing based on legitimate interests, and you can ask a company to restrict processing while a dispute is sorted out. If you object to your content being used for training, say so clearly and keep a copy of your message.
Automated decisions: what changed in 2026
The biggest recent change concerns decisions made solely by automated means. Think of a loan application refused by software, a job application filtered out before any person reads it, or an account frozen by a fraud system. Under the old UK GDPR Article 22, such significant decisions were generally prohibited unless a narrow exception applied, such as your explicit consent or necessity for a contract.
From 5 February 2026, section 80 of the Data (Use and Access) Act 2025 replaced Article 22 with new Articles 22A to 22D. The default flipped. A significant decision based solely on automated processing is now permitted on any lawful basis, provided the controller puts safeguards in place. Those safeguards, set out in Article 22C, include giving you information about the decision, letting you make representations, letting you obtain human intervention, and letting you contest the outcome.
One important exception remains. Decisions based on special category data, which includes health data, ethnicity, religious beliefs, trade union membership, and biometric and genetic data, stay tightly restricted under Article 22B. They need explicit consent, or a contract or legal authorisation combined with a substantial public interest.
What does this mean for you in practice? If an AI system makes a decision about you with no meaningful human involvement, you can still ask for a human to review it and challenge it. The route to that challenge matters more than ever, so keep the decision notice, the date, and any reference number.
What to check before you use an AI tool
Use this short checklist before you paste personal information into any AI tool.
First, read the privacy notice section on training and retention. Check whether your prompts are used to train models, and whether you can opt out. Second, check the retention period. Some tools delete temporary chats within 30 days, while standard chats may be kept until you delete them. Third, check what happens to uploads. Photos and documents may be stored separately from chats, with different deletion rules. Fourth, check sharing. Some tools share data with service providers, affiliates, or law enforcement on request.
Fifth, use the safety settings. Turn off training on your content where the tool allows it, switch on temporary or private chat modes for sensitive questions, and review stored memories regularly. Our guide on whether ChatGPT saves your data walks through these settings for the most popular chatbot.
What businesses must do with your data
The duties sit mainly with businesses, but knowing them helps you spot poor practice. A business using AI must have a lawful basis for processing, such as consent, contract, or legitimate interests. It must collect only the data it needs, keep it accurate, and store it no longer than necessary. It must also be transparent about automated decision making and profiling.
Where AI poses a higher risk to your rights, the business should carry out a data protection impact assessment. That is a structured review of the risks and the safeguards. You will not usually see this document, but you can ask whether one has been done if a tool makes decisions about you.
Children’s data gets extra protection. AI tools aimed at, or widely used by, children must meet the ICO’s Age Appropriate Design Code, which pushes for high privacy settings by default and clear explanations. If you are a parent, check the minimum age in the terms and the default privacy settings before letting a child use an AI app.
AI and GDPR in the wider UK picture
GDPR is only one part of the UK framework. The Online Safety Act covers harmful content and platform duties. The EU AI Act sets separate rules for high risk AI systems sold in Europe, but it does not replace UK GDPR for UK users. Our plain English guide to UK AI regulation explained for 2026 puts these pieces together.
The regulator to know is the Information Commissioner’s Office, the ICO. If a company ignores your rights request or you believe it has misused your data, you can complain to the ICO after giving the company a chance to put things right. Keep copies of your requests and replies, because dates and wording matter in a complaint.
Practical tips for everyday AI use
Do not paste passwords, bank details, medical records, or other people’s private information into a public chatbot. Remove names and identifying details from documents before uploading them for summaries. Use a separate account for work and personal use where possible, so a work admin cannot see personal chats. Check the settings after every major app update, because defaults sometimes change.
If an AI tool gives you a wrong or unfair outcome, act quickly. Ask for the reasons, ask for human review, and put your challenge in writing. If the decision involved special category data, say so explicitly, because the tighter rules may apply. For a broader safety check, see whether ChatGPT is safe to use, which covers privacy, misinformation, and settings in one place.
Frequently asked questions
Does GDPR stop companies using my data to train AI?
No, not automatically. A company needs a lawful basis, and it must be transparent about training. You can often opt out in settings or object to processing based on legitimate interests, but the exact route depends on the tool. Check the privacy notice and keep a record of your opt out.
Can I ask an AI company to delete everything it holds about me?
You can ask, and the company must consider your request under the right to erasure. Account data, chats, and uploads can usually be deleted. Data already used in model training is harder to remove, and the company should explain what deletion covers and what it cannot undo.
What is a significant automated decision?
It is a decision based solely on automated processing, with no meaningful human involvement, that has legal effects or similarly significant effects on you. Examples include a refused loan, a rejected job application, or a frozen account. A tool that only helps a human decide, where the human genuinely weighs the result, is treated differently.
Do I still have the right to human review after the 2026 change?
Yes. Under the new Articles 22A to 22D, the safeguards include information about the decision, the chance to make representations, human intervention, and the right to contest the outcome. The change widened the lawful bases for such decisions, but it did not remove these safeguards.
Who do I complain to if an AI company ignores my rights?
First, complain to the company and give it time to respond. If you are not satisfied, you can complain to the ICO, the UK data protection regulator. Keep copies of every message, because the ICO will want to see the timeline.
Conclusion
AI and GDPR come down to a simple idea. AI companies can use your data, but only within clear limits, and you keep real rights over it. Know what you are sharing, use the privacy settings, and challenge any automated decision that affects you. The 2026 rule change shifted how automated decisions are justified, but it kept the safeguards that let you ask for a human and contest the result. Stay informed, keep records, and treat your prompts and uploads as data that deserves the same care as any other personal information.
