Tag: ICO guidance
AI is changing how people ask questions
The ICO has published new guidance on AI-generated FOI requests to help public authorities deal with Freedom of Information requests involving artificial intelligence.
The guidance explains that people now use AI tools to help them make information requests. As a result, some requests may look longer, more formal or more complex than before. Some may also rely on wording that does not quite fit the law.
Why this matters beyond FOI
At first, this may sound like a public sector issue.
However, private businesses should still pay attention.
If people can use AI tools to write Freedom of Information requests, they can also use them to write subject access requests, complaints, contract challenges and customer queries.
Therefore, this is not just a story about FOI.
It gives businesses a useful warning about what comes next.
People now have tools that help them ask formal questions quickly. Sometimes those questions will make sense. Sometimes they will not. Either way, businesses need to know how to respond.
Why this matters for UK businesses
Freedom of Information law applies to public authorities. Therefore, most private businesses do not need to respond to FOI requests.
However, private businesses do need to deal with data protection rights under the UK GDPR.
For example, individuals may ask for a copy of their personal data through a subject access request. Athlex has a helpful DSAR guide for SMEs that explains what these requests involve and why they can become difficult to manage.
Individuals may also ask how your business uses, shares, stores or deletes their data.
AI can make requests look more formal
Because of AI tools, those requests may now look more detailed.
They may also sound more legal than before.
That does not mean the request is correct. However, your business still needs a clear process for handling it.
In practice, your team should know:
- who deals with requests;
- how they track deadlines;
- where they can find personal data;
- when they need legal input;
- how they check whether AI tools play a role;
- how they respond clearly and fairly.
Without that structure, even a simple request can create stress.
Once stress enters the process, mistakes become more likely. Because apparently one awkward email can still ruin everyone’s afternoon.
The real risk is not the AI-generated request
AI-generated requests may feel frustrating. They may run too long. They may quote the wrong law. They may also ask for information the person cannot receive.
However, the request itself is not the main risk.
The bigger risk appears when your business cannot explain what it does with personal data.
Requests test your data protection controls
For example, a business may struggle if it cannot explain:
- what personal data it holds;
- why it holds that data;
- where teams keep it;
- who can access it;
- which suppliers process it;
- whether AI tools use it;
- how long the business keeps it;
- whether the privacy notice matches reality.
As a result, a request can quickly become more than an admin task.
It can test your data protection controls.
It can also show whether your policies match what actually happens inside the business.
If you need practical support reviewing your current position, Athlex’s GDPR consultancy services can help you assess gaps and decide what needs attention first.
AI makes transparency more important
Many businesses already use AI in everyday ways.
For example, they may use AI to:
- summarise customer emails;
- support recruitment;
- review complaints;
- analyse customer behaviour;
- support fraud checks;
- write internal notes;
- power website chatbots;
- prioritise sales leads.
Some of these uses may feel low risk.
However, personal data changes the position.
If an AI tool uses personal data, the business needs to understand what happens to that data.
That means asking clear questions.
What data does the tool use? Why does the business use it? Has the business told the person? Does a supplier help process the data? Can the supplier use the data to train the tool? Could the output affect someone?
These are not abstract legal questions.
They are practical business questions.
Increasingly, customers, staff and regulators may expect clear answers.
Automated decision-making is where AI gets serious
Some AI tools simply help teams work faster. Others go further. They may help decide who gets an interview, whether a transaction looks suspicious, what price someone is offered, or whether a customer should receive a service. At that point, AI is no longer just a helpful tool in the background. It may be influencing decisions that affect real people.
That is why automated decision-making needs special care.
The Data Use and Access Act 2025 has changed parts of the UK’s data protection rules. In simple terms, it gives organisations more flexibility to use automated systems for significant decisions. However, the ICO is clear that this flexibility depends on appropriate safeguards still being in place.
So, this is not a free pass to hand decisions to AI and walk away whistling. Where an automated decision has a legal or similarly significant effect on someone, businesses still need to think carefully about fairness, transparency and challenge. For example, people may need to be told about the decision, given a chance to challenge it, allowed to make their views known and given access to meaningful human involvement.
This matters for businesses using AI in areas such as:
* recruitment;
* fraud checks;
* lending or affordability decisions;
* customer risk scoring;
* access to services;
* pricing;
* complaints handling.
The key question is not simply:
Are we using AI?
The better question is:
Could this AI use affect someone in a meaningful way?
If the answer is yes, the business needs to slow down and check the rules before the system goes live.
That means understanding what the AI tool does, what data it uses, how decisions are made, what role humans play and how people can challenge the outcome. Because “the system recommended it” is not a data protection strategy.
It is a sentence that usually arrives shortly before someone asks for evidence. In short, AI can support better decisions. However, businesses still need to understand how those decisions are made and whether people have proper safeguards.
A human review also needs to be real. If someone simply accepts the AI output without thinking, that is not meaningful oversight. It is just automation wearing a human hat, which is less comforting than some people seem to think.
What businesses should do now
The answer is not to panic.
It is also not to ban every AI tool and pretend everyone will go back to manual spreadsheets.
Instead, businesses should take practical steps.
1. Map where AI is being used
First, find out where AI is being used across the business.
This should include obvious tools, such as chatbots and AI platforms. However, it should also include less obvious uses in HR, marketing, sales, customer service, finance and operations.
For each use, ask:
* Is personal data involved?
* What is the AI tool doing?
* Is a supplier involved?
* Is the output used to make decisions?
* Has anyone checked the data protection position?
This does not need to be complicated. However, it does need to be clear.
2. Review your privacy notices
Next, check whether your privacy notices still reflect reality. If your business uses AI in a way that affects personal data, your privacy information may need to explain this. For example, you may need to explain what data is used, why it is used, who it is shared with and what rights people have. A privacy notice should not be a dusty webpage that nobody trusts. Instead, it should be a clear explanation of what actually happens. Athlex can support businesses with practical privacy notice and compliance reviews through its data protection services.
3. Prepare for AI-assisted DSARs and complaints
Businesses should also prepare for more detailed requests and complaints. For example, people may use AI to help them ask about:
* what personal data you hold;
* how AI tools use their data;
* whether decisions are automated;
* how long information is kept;
* whether data has been shared with suppliers;
* whether they can object or challenge a decision.
In addition, AI tools may make complaints look more formal, more detailed and more legal than before. Some complaints may be valid and well explained. However, others may be based on misunderstandings, incorrect assumptions or wording copied from an AI tool without much thought behind it. As a result, your DSAR and complaint process should be easy to follow.
Your team should know what to do, who to involve and when to escalate. They should also understand how to respond clearly when a complaint is broad, unclear, abusive, repetitive or based on incorrect legal points.
That way, the business can respond properly without turning one email into a full organisational incident.
Received a data protection complaint and not sure what to do first?
Athlex has created a free Data Protection Complaints Checklist to help businesses take a calm, practical first step when a data protection complaint comes in.
The checklist helps you think through:
* what the complaint is actually about;
* whether personal data is involved;
* whether there is a potential breach;
* who needs to be involved internally;
* what evidence should be kept;
* when the issue should be escalated;
* how to avoid making the situation worse.
It is designed to help you respond clearly, quickly and with more confidence.
Ask us for your free checklist – hello@athlex.co.uk
4. Check your supplier contracts
AI suppliers can create hidden risks. Therefore, before using AI tools with personal data, businesses should check the contract position. In particular, they should understand:
* whether the supplier is a processor or controller;
* where the data is stored;
* whether the supplier uses the data to train AI models;
* which sub-processors are involved;
* what security measures apply;
* what happens if there is a breach;
* whether the supplier can support DSARs and deletion requests.
If those answers are unclear, the business may not be ready to use the tool with personal data. That may slow things down. However, it is better than discovering the issue after a complaint. If you are reviewing AI supplier terms, Athlex’s contract and clause review support can help you understand the risks before you sign.
5. Use DPIAs for higher-risk AI
Finally, businesses should complete a Data Protection Impact Assessment where AI use is likely to create higher risks. A DPIA helps identify privacy risks before a project goes live. It is especially useful where AI is used for profiling, monitoring, recruitment, fraud checks, special category data or decisions that may affect people.
A good DPIA should ask:
* Is this use of AI necessary?
* Is it fair?
* Can we explain it?
* Could it harm people?
* Are the safeguards strong enough?
* Can a human properly review the outcome?
In other words, a DPIA should not be treated as a form to complete at the end. It should help the business make better decisions from the start. Athlex provides DPIA support for businesses that need practical guidance on higher-risk processing, including AI projects.
The Athlex view: AI readiness is now part of data protection readiness
The ICO’s guidance on AI-generated FOI requests is aimed at public authorities. However, the wider message applies to many organisations. AI is changing how people ask questions. It is also changing how businesses use personal data. As a result, data protection processes need to keep up. For UK businesses, this means AI governance should not sit in a separate future project.
Instead, it should be built into everyday data protection work. That includes:
* clear records of processing;
* accurate privacy notices;
* strong supplier checks;
* practical DPIAs;
* clear DSAR processes;
* sensible human review;
* evidence of decisions;
* a clear process for handling complaints.
The businesses that manage this well will not be the ones with the longest AI strategy document. They will be the ones that can explain what they are doing, show why it is fair and respond properly when challenged. That is what builds trust. And trust is still one of the strongest data protection tools a business has. For businesses that need ongoing support, Athlex’s outsourced DPO services can help keep data protection work moving without adding pressure to already stretched teams. https://athlex.co.uk/outsourced-dpo/
Need help with AI, complaints and data protection?
Athlex helps UK businesses understand data protection in a clear and practical way. We support businesses with AI risk reviews, DPIAs, privacy notices, DSAR processes, supplier checks, complaint handling and outsourced DPO support. If your business is using AI, planning to use AI, or only just realising that your teams are already using it, now is the time to get your data protection foundations in order.
Not sure where to start with a complaint? Get our free Data Protection Complaints Checklist and get clear, practical steps for handling complaints before they escalate.
Athlex makes data protection clear, practical and built for real business decisions. Data protection made simple.
In the digital age, protecting customer data isn’t just good practice – it’s a legal requirement. Since the implementation of GDPR in 2018, UK businesses face unprecedented obligations to safeguard personal information. The consequences of non-compliance can be devastating, with fines reaching up to 4% of annual global turnover or £17.5 million, whichever is higher. This reality makes professional data protection services essential for businesses of all sizes.
Understanding the Data Protection Landscape
The data protection landscape has evolved dramatically over recent years. What once seemed like a concern primarily for large corporations now affects every organisation that processes personal data. From small retail shops collecting customer emails to multinational corporations handling millions of records, the requirements remain equally stringent.
Many business owners underestimate the complexity of data protection regulations. GDPR compliance involves far more than simply adding a privacy policy to your website. It requires a comprehensive understanding of data flows, processing activities, legal bases for processing, and individual rights. The regulations touch every aspect of how organisations collect, store, use, and delete personal information.
The stakes have never been higher. Data breaches make headlines regularly, damaging reputations and resulting in significant financial penalties. In 2023 alone, the Information Commissioner’s Office issued millions of pounds in fines to UK organisations for data protection failures. These weren’t just technology giants – they included healthcare providers, retailers, and local authorities.
The Role of a Data Protection Officer
Under GDPR, certain organisations must appoint a data protection officer. This requirement applies to public authorities, organisations whose core activities involve large-scale systematic monitoring, or those processing special category data on a large scale. However, even when not legally required, having access to DPO services UK businesses can rely on proves invaluable.
A skilled data protection expert brings specialised knowledge that most internal teams lack. They understand the nuances of privacy compliance, stay updated on regulatory changes, and can translate complex legal requirements into practical business processes. Their expertise helps organisations navigate the intricate balance between operational efficiency and regulatory compliance.
The responsibilities of a data protection officer extend far beyond basic compliance tasks. They serve as the primary point of contact with supervisory authorities, conduct privacy impact assessments, provide staff training, and ensure the organisation maintains appropriate technical and organisational measures. This comprehensive role requires both legal knowledge and practical business acumen.
Benefits of Outsourced Data Protection
For many organisations, an outsourced DPO provides the perfect solution. Rather than hiring a full-time specialist, businesses can access expert guidance when needed while controlling costs. This approach offers several distinct advantages that make it particularly attractive for small and medium-sized enterprises.
Cost efficiency stands out as a primary benefit. Hiring a qualified in-house data protection officer commands a significant salary, often exceeding £60,000 annually. Add recruitment costs, ongoing training, and employee benefits, and the investment becomes substantial. Outsourced data protection services provide the same expertise at a fraction of the cost.
Independence represents another crucial advantage. An external GDPR consultant brings objectivity that internal staff might struggle to maintain. They can challenge existing practices, identify vulnerabilities, and recommend changes without concern for internal politics or relationships. This independence proves particularly valuable during audits or investigations.
Flexibility allows organisations to scale support according to their needs. During quiet periods, they might require minimal assistance. When implementing new systems or responding to data subject requests, they can increase support accordingly. This adaptability ensures businesses receive appropriate help without paying for unused capacity.
Common Data Protection Challenges
Modern businesses face numerous data protection challenges. Understanding these common pitfalls helps organisations appreciate why professional support proves so valuable. Many companies struggle with basic requirements, let alone the more complex aspects of compliance.
Data mapping often presents the first hurdle. Organisations frequently lack a clear picture of what personal data they hold, where it’s stored, and how it flows through their systems. Without this fundamental understanding, achieving compliance becomes impossible. Professional services help create comprehensive data inventories that form the foundation of effective data protection strategies.
Consent management creates ongoing headaches for many businesses. GDPR raised the bar for valid consent, requiring it to be freely given, specific, informed, and unambiguous. Many organisations still rely on pre-ticked boxes or buried consent clauses that no longer meet legal standards. Expert guidance ensures consent mechanisms meet current requirements while remaining user-friendly.
Third-party risk management represents another significant challenge. Most businesses share data with suppliers, partners, or service providers. Each relationship creates potential vulnerabilities. Proper data processing agreements, due diligence procedures, and ongoing monitoring help manage these risks effectively.
Data Breach Prevention Strategies
Preventing data breaches requires more than good intentions. It demands systematic approaches to identifying and addressing vulnerabilities before criminals exploit them. Effective data breach prevention combines technical measures, organisational policies, and staff awareness.
Technical safeguards form the first line of defence. Encryption, access controls, and regular security updates help protect data from external threats. However, technology alone isn’t sufficient. Human error remains the leading cause of data breaches, making staff training and awareness crucial components of any prevention strategy.
Incident response planning proves equally important. Despite best efforts, breaches can still occur. Organisations with robust response plans minimise damage and demonstrate accountability to regulators. These plans should detail roles, responsibilities, and procedures for containing breaches, assessing impact, and notifying affected individuals and authorities within required timeframes.
Regular testing validates prevention measures. Penetration testing, vulnerability assessments, and simulated phishing attacks help identify weaknesses before real attackers find them. Professional data protection services include these assessments, ensuring organisations maintain effective defences against evolving threats.
The Future of Data Protection
Data protection requirements will only intensify in coming years. Emerging technologies like artificial intelligence and Internet of Things devices create new privacy challenges. Regulatory frameworks continue evolving to address these developments, making ongoing compliance increasingly complex.
International data transfers face growing scrutiny. Following the Schrems II decision, organisations must carefully assess the legal basis for transferring data outside the UK. New standard contractual clauses and transfer impact assessments add layers of complexity that require expert navigation.
Consumer awareness continues rising. People increasingly understand their data rights and won’t hesitate to exercise them. Organisations must prepare for more data subject requests, complaints, and scrutiny from privacy-conscious customers. Meeting these expectations requires robust processes and knowledgeable staff.
Choosing the Right Support
Selecting appropriate data protection support requires careful consideration. Organisations should evaluate potential providers based on qualifications, experience, and understanding of their specific industry. The right partner combines technical expertise with practical business sense.
Look for providers offering comprehensive services. Basic compliance checking isn’t sufficient – organisations need partners who understand their business, identify risks, and provide pragmatic solutions. The best providers offer ongoing support rather than one-off assessments.
Consider the provider’s approach to knowledge transfer. Effective partners don’t just solve immediate problems – they help organisations build internal capabilities. Through training, documentation, and mentoring, they enable businesses to handle routine matters independently while remaining available for complex issues.
Making Data Protection Work for Your Business
Effective data protection shouldn’t hinder business operations. When implemented properly, it enhances customer trust, improves operational efficiency, and creates competitive advantages. The key lies in finding the right balance between protection and practicality.
Start by understanding your current position. Conduct a thorough assessment of existing practices, identify gaps, and prioritise improvements based on risk and resource availability. Professional support accelerates this process, helping organisations focus efforts where they’ll have maximum impact.
Build data protection into business processes from the outset. Privacy by design principles ensure new projects consider data protection requirements from conception rather than retrofitting compliance later. This approach reduces costs and creates more effective solutions.
Conclusion
Data protection represents both a legal obligation and business opportunity. Organisations that embrace comprehensive data protection strategies build trust, avoid penalties, and position themselves for sustainable growth. While the complexity of requirements can seem overwhelming, professional support makes compliance achievable.
Athlex Ltd provides expert data protection services tailored to UK businesses. Our team of qualified specialists understands the challenges organisations face and delivers practical solutions that balance compliance with operational needs. Whether you need ongoing DPO support or project-based assistance, we help protect your business and your customers’ data. Contact our expert team to discuss how we can support your data protection journey.
