Customer data when AI agents do the work

An AI agent that serves customers can see their names, orders and messages. The Information Commission (which took over from the ICO on 30 September 2026) has guidance for organisations that use AI with personal data.

Only the data the agent needs

The Information Commission says the personal data you process must be adequate for your purpose, relevant to it and limited to what is necessary. Its checklist includes reviewing the data you hold from time to time and deleting anything you don't need.

Telling customers what happens to their data

You have to tell customers why you use their data, how long you keep it, and who you share it with. You give them this when you collect the data from them, or within a reasonable time, and no later than a month, if it comes from somewhere else. You point out any new use of it before that use begins.

The Information Commission allows a few exceptions, for example where the person already has the information.

Decisions with no person involved

Parliament changed the UK GDPR's rules on automated decision-making in the Data (Use and Access) Act 2025, and the new rules have applied since 5 February 2026. In March 2026 the ICO brought out a revised draft of its guidance on them, and the Information Commission is consulting on it. The guidance is about decisions based solely on automated processing, with no meaningful human involvement, that have a legal or similarly significant effect on a person.

It sets out safeguards for those decisions. They cover telling people about the decisions, letting them make representations, letting them ask for a person to step in, and letting them contest a decision.

Its broader guidance on AI and data protection is being reviewed in the light of that Act, the Information Commission says. It marks its pages on data minimisation, privacy information and DPIAs as under review too.

Weighing the risk before you start

In a data protection impact assessment (DPIA), a business weighs the risks of a plan before the processing begins. The Information Commission lists the kinds of processing that need one. AI is on the list where it comes with one of the other high-risk criteria in the European guidelines the list builds on. The list also includes any decision about a customer's access to a product, service or benefit that is based to any extent on automated decision-making. The Information Commission says a DPIA is good practice even where the processing is not likely to be high risk.

Security

The National Cyber Security Centre (NCSC) writes for providers of any system that uses AI, including one built on other companies' tools and services. It splits its advice into four areas: secure design, secure development, secure deployment, and secure operation and maintenance.

In its AI Cyber Security Code of Practice, published in January 2025, the government sets out baseline principles for securing AI systems and the organisations that develop and deploy them.

Useful links