UK GDPR and AI: the Data Protection Act 2018, ICO guidance and US AI providers

A claims handler in Leeds asks Claude to summarize a file before a call. The file has a National Insurance number, an NHS number, a home postcode and two pages about a back injury. The handler wants a summary in 30 seconds. The UK GDPR wants to know why an AI provider in the United States needed the NI number to write it.

Since Brexit, the UK runs its own version of the GDPR alongside the Data Protection Act 2018. The rules are still close to the EU text, but the regulator, the transfer mechanisms and some recent amendments are British. Here's what applies when you put AI models to work on personal data in the UK, as of October 2026.

What are the UK GDPR and the Data Protection Act 2018?

The UK GDPR is the retained version of the EU regulation, adapted for the UK. The DPA 2018 sits next to it and fills in the detail: conditions for special-category data, exemptions, law enforcement and intelligence processing, and the ICO's powers. Fines reach GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends both, including the rules on automated decision-making. Its provisions are being brought into force in stages by regulations, so check which parts apply on the date you read this. None of the changes remove the core duties below: lawfulness, minimization, security, accountability and lawful transfers.

What does the ICO expect from organizations using AI?

The ICO's main reference is its Guidance on AI and data protection, last substantially updated in March 2023 and under review as of October 2026. It sits alongside Explaining decisions made with AI (written with the Alan Turing Institute), an AI and data protection risk toolkit, and the outcomes of the ICO's 2024 consultation series on generative AI. The ICO has also said it's working on a statutory code of practice on AI and automated decision-making. Watch for it, because a statutory code carries more weight than guidance.

Read together, the ICO's expectations for an organization that uses a third-party model, rather than building one, come down to a handful of things:

• Accountability: you're responsible for the processing you choose to do with an AI tool, even when the model belongs to someone else.
• DPIA: the ICO says most uses of AI involving personal data are likely to need one. Do it before rollout, not after.
• Minimization: only process the personal data you need. The ICO explicitly mentions privacy-enhancing techniques such as pseudonymization.
• Security: AI brings new risks, from prompt injection to model output revealing input data. Assess them under Art. 32.
• Transparency and fairness: tell people when AI plays a part in decisions about them, and check outputs for bias.
• Individual rights: be ready to handle access and objection requests for data the AI process holds.

How do transfers to US AI providers work from the UK?

The UK has its own adequacy regime. The UK extension to the EU-US Data Privacy Framework, usually called the UK-US data bridge, took effect on 12 October 2023. It lets you send personal data to US organizations that have self-certified to the DPF and opted into the UK extension. Check both on the official DPF list: a provider certified for the EU framework isn't automatically covered for UK data.

Without the bridge, you need the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, plus a transfer risk assessment. The UK bridge depends on the EU framework, so the pending challenge to the DPF before the Court of Justice matters to UK transfers too. Masking reduces what crosses either way: an NI number that becomes a token is no longer an NI number in a US data center.

What does the Maskflare UK GDPR profile cover?

The UK GDPR profile turns on the United Kingdom country pack plus the global, healthcare, person-name and credentials packs. In practice that means names, email addresses and phone numbers, National Insurance numbers, NHS numbers, UK passport and driving licence numbers, postcodes, UK IBANs, health identifiers such as medical record numbers, and secrets like API keys pasted by mistake. Like every profile, it's a floor: it turns detectors on and raises weak actions to at least mask, but never turns anything off. The change goes through your normal approval flow.

Two honest notes. First, the coverage report in the console is built for HIPAA's 18 identifiers and the EU GDPR's categories, so for UK GDPR you get the profile and the audit evidence rather than a UK-specific category report. Second, the healthcare pack finds health identifiers. A paragraph describing a back injury isn't detected as health data, so prose about health still needs a policy decision.

UK GDPR requirements, what Maskflare does, and what stays your job

A practical checklist for UK organizations

1. Inventory AI tools in use, including browser use of ChatGPT, Claude and Gemini by staff.
2. Run a DPIA for each AI use case that touches personal data, using the ICO's AI risk toolkit as a structure.
3. Confirm each US provider's DPF certification includes the UK extension, or sign the IDTA or UK Addendum.
4. Apply the UK GDPR profile and add custom rules for your own reference formats: claim numbers, policy numbers, case IDs.
5. Use Exact Data Match for your customer list so known names and account numbers are caught even when the format is unusual.
6. Decide what happens to health prose and other special-category text: block the workflow, mask by dictionary or accept with a documented reason.
7. Track the Data (Use and Access) Act commencement and the ICO's statutory AI code, and revisit the DPIA when they land.

What masking won't do for you

It won't give you a lawful basis, write your privacy notice or answer a subject access request. No detector catches every name in every context, so test with your own documents. And it can't help with data you never route through it, which is why getting browser and desktop use onto the same policy as your apps matters more than any single detector.