United Kingdom: the instruments named

ISO/IEC FDIS 27091ReferenceNo new requirement

The UK GDPR and the Data Protection Act 2018 set the privacy duty, and the regulator has published guidance on AI and data protection. This page names them and does not state their text.

What this page covers

• The UK GDPR and the Data Protection Act 2018: the principles, the lawful basis, the impact assessment and the rights of the person.
• ICO guidance on AI and data protection, including explainability, fairness and the use of personal data in training.
• Sector rules where they apply, including the FCA and the NHS.
• The UK's approach to AI regulation, which places duties on existing regulators rather than on a single AI statute.

How to use it

Record the UK GDPR basis and the impact assessment for each system used on UK residents, and check the ICO guidance when the system profiles or makes a significant decision.

What it does not add

This page does not state the UK GDPR or the 2018 Act and is not legal advice. The law and the guidance change; verify the current version.

Read across

• Control A.5.2, AI system impact assessment process
• Control A.5.5, Assessing societal impacts of AI systems