AiCore logo

Lesson 1 — Data Protection and UK GDPR

Unit 4 | Lesson 1 of 3

By the end of this lesson, you will be able to:

  • Recognise what counts as personal data in an AI context — including the less obvious categories (K2)
  • Name the lawful bases for processing and identify which usually apply to workplace AI (K2)
  • Recognise special category data and the additional protection it needs (K2)
  • Explain when the automated decision-making rules (Articles 22A to 22D) apply and why meaningful human review matters (K2)
  • Judge whether your own project is lawful, and know when to escalate to a Data Protection Officer (K2)
Download Unit 4 Workbook

📅 Legal position correct as of September 2026. Legislation and regulator guidance change; every claim below links to its source, so check the source before relying on the claim.

Why data protection is not optional

This unit is where you learn the legal and ethical frameworks that decide whether your project is viable and responsible — the same way Unit 3 asked whether it was worth doing. You have already met the reason it matters: in the Unit 2 Demo Lab, a law firm, an NHS trust and an FCA-regulated firm could not casually send documents to a third-party platform. The framework behind that judgement is the UK GDPR (with the Data Protection Act 2018, both as amended by the Data (Use and Access) Act 2025), regulated by the Information Commissioner's Office (ICO) — which the same Act will reconstitute as the Information Commission.

If your project touches data about people — and almost every AI project does — it applies to your work. You do not need to be a lawyer. You need to know enough to ask the right questions, judge your own project, and escalate what you cannot answer.

What counts as personal data — it is broader than names

Personal data is any information relating to an identifiable living person. The test is identifiability, not whether an obvious identifier like a name is present. In an AI context, the following regularly count:

  • Behavioural patterns — what someone clicks, when they respond, how long they spend.
  • Voice and image data — call recordings, photos, video (sometimes also biometric data, which is more sensitive).
  • Inferred characteristics — anything an AI infers about a person (likely health, income, or views) is personal data even if never directly observed.

If several data points together could identify someone, that combination is personal data even when no single point could.

You need a lawful basis before you process it

UK GDPR gives six lawful bases that matter for ordinary business processing; at least one must genuinely apply, and you identify it in advance:

  1. Consent — freely given, specific, informed. Usually the wrong choice at work: the employer–employee power imbalance makes it hard to rely on.
  2. Contract — processing necessary to deliver a service to the person.
  3. Legal obligation — required by law (e.g. tax, fraud reporting).
  4. Vital interests — to protect someone's life (narrow).
  5. Public task — for public-interest/official functions (mostly public sector).
  6. Legitimate interests — a genuine interest, necessary, that does not override the person's rights — and it requires a documented Legitimate Interests Assessment (LIA).

For completeness, the Data (Use and Access) Act 2025 added a seventh, recognised legitimate interests, which drops the balancing test but is limited to the public-interest purposes listed in Annex 1 — disclosure to someone who needs the data for a public-interest task; national security, public security and defence; emergencies; detecting, investigating or preventing crime and apprehending or prosecuting offenders; and safeguarding vulnerable individuals. That is the whole list, and commercial AI work sits outside it.

Most internal workplace AI leans on legitimate interests or contract.

Special category data needs extra protection

Some data is especially sensitive and needs an additional Article 9 condition: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and data about sex life or sexual orientation. The common trap is processing it without realising — a call-transcription tool can capture health information; sentiment analysis on staff emails can infer political views. If you are unsure whether it is present, that uncertainty is itself a flag to raise.

Automated decisions carry special rules (Articles 22A to 22D)

This is the part of UK GDPR that changed most recently, so it is worth being precise about what the law now says. Until 5 February 2026, Article 22 banned solely automated decisions with a legal or similarly significant effect unless a narrow exception applied. Since then the Data (Use and Access) Act 2025 has replaced Article 22 with Articles 22A to 22D and the default has flipped: such a decision is now permitted on an ordinary lawful basis — usually legitimate interests — provided the safeguards are in place.

A decision made solely by an automated system that has a legal or similarly significant effect (a job rejection, a credit refusal) requires the Article 22C safeguards: the person must be given information about the decision, be able to make representations about it, be able to obtain meaningful human intervention, and be able to contest the outcome. A rubber-stamp glance does not count as meaningful — the reviewer must actually see the output, have the information to judge it, and have authority to overturn it. That test has not changed, and it is the legal backbone of the human-in-the-loop design principle from Unit 1.

Two things to hold on to. First, the safeguards are what make the automation lawful, so a sound lawful basis on its own is not enough. And one caveat: because the change is so recent, the ICO's detailed guidance on these provisions is still in draft and out for consultation — the best available reading, not the last word. Second, special category data is the exception: where the decision draws on it, materially stricter conditions still apply, so treat those cases as high-risk and escalate them.

Build for the minimum, and know who to ask

Two design principles matter from the start, not at sign-off:

And where your organisation has a Data Protection Officer (DPO), involve them early and flag to them whenever you are unsure. Knowing who to ask is part of the competence.

📚 Extended reading — the depth is revisited in Module 10. The full detail — the three-part LIA, the nuance of "solely automated", data-subject rights (access, explanation, objection, erasure), retention, and how UK and EU GDPR differ across borders — is covered at documentation depth in Module 10 (Governance & Compliance). One difference is worth knowing now: the automated decision-making reform is a UK-only change, so EU GDPR still bans those decisions by default. For now, work at practitioner level: recognise the issue, judge your project, escalate what you cannot resolve.

An AI system routes customer emails to departments using the email text and the customer's account tier. No name or email address is stored. From a UK GDPR perspective, which statement is most accurate?

An AI system automatically scores job applications and sends rejection emails below a threshold, with no human review. Which is most accurate?

📝 Activity — Data-protection self-check

Complete Section 1 of your Module 1 Workbook (Unit 4 section), applying the framework to your chosen project process. The questions guide you through:

  1. Whether your process involves personal data — what type, and whose
  2. Which lawful basis applies, and why
  3. Whether special category data is involved — directly or indirectly
  4. Whether your AI makes automated decisions with legal or significant effects, and whether the Article 22C safeguards are in place — including where the meaningful human intervention sits
  5. A Flag for what needs escalating to a DPO or legal colleague before your project proceeds

The workbook includes space to answer from your own knowledge, and an optional AI assist space to note what a GenAI tool added, confirmed, or missed. The flag question has no AI assist space — that judgement is always yours.

These notes also feed your Module 2 Responsible AI Adoption Plan, where you will apply these frameworks at full depth.

Further reading:

⏭️ Up next — Lesson 2: with data protection covered, Lesson 2 turns to employment law, equality, and the responsible-AI regulatory landscape.

Next: L4.2 — Equality, Employment & Responsible AI