What the ICO expects when staff use AI.

Three parts of UK GDPR do the work, and none of them mention AI, because they do not need to.

• Article 5(1)(f), integrity and confidentiality. Personal data must be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing. A client’s details typed into a personal chatbot account are being processed by whoever runs that account.
• Article 32, security of processing. The firm must put in place appropriate technical and organisational measures. The ICO has been consistent for years that staff training is an organisational measure, and that a policy nobody has been trained on is not one.
• Article 39(1)(b), the DPO’s tasks. Where a firm has a data protection officer, awareness-raising and training of the staff involved in processing is written into their job.

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Pasting a client’s name and circumstances into a tool that the firm has not assessed, on an account the firm does not control, can meet that definition, whether or not anyone at the tool’s vendor ever reads it.

Under Article 33 a breach must be reported to the ICO within 72 hours of the firm becoming aware of it, unless it is unlikely to result in a risk to the people concerned. Either way the firm has to record it, with its assessment of why it did or did not report. That record is only possible if the member of staff tells someone the same day, which is why the reporting route is a training matter rather than a paperwork one.

The ICO’s guidance on AI and data protection, and its consultation series on generative AI, put the emphasis in the same three places: a lawful basis for any personal data that goes into a tool, purpose limitation so that data collected for one thing is not fed into another, and keeping personal data out of tools that were never assessed for it. The ICO expects a firm to know which tools its staff use, and to be able to show that the people using them understand the rules.

Cyber Essentials is about five technical controls: firewalls, secure configuration, access control, malware protection and patching. It is the right certification to hold, and it says nothing about what a member of staff types into a chat window. A firm can be fully certified and still lose a client’s file through a prompt. The gap between the two is exactly what AI training closes.

When the ICO looks at a firm after an incident, the questions are practical.

• Was there a policy that named the approved tools and the rules for personal data?
• Were staff trained on it, and when? Is there a register?
• Had the tools in use been assessed for personal data before staff used them?
• Was the incident spotted, reported internally and recorded promptly?

A firm that can answer all four with documents is in a very different position from one that can only say it told people to be careful.