ICO Publishes Report on Data Protection Compliance of Generative AI Foundation Model and Calls for Evidence

By: Sarah Pearce and Sophie Verstraeten

The UK Information Commissioner’s Office (ICO) has published the findings of a two-year supervision programme examining leading generative AI foundation model developers. The report sets out the ICO’s expectations for organisations using personal data to train AI models and identifies key areas of regulatory concern.

The ICO reiterates that organisations must identify a lawful basis for processing personal data, provide meaningful transparency, facilitate the exercise of data subject rights, and implement safeguards that reduce risks to individuals. The regulator also makes clear that the complexity of AI systems is not a justification for noncompliance and that it will take action where avoidable harms arise.

A key finding of the programme was a lack of transparency across the AI sector. The ICO found that many developers do not sufficiently understand whether their training datasets contain personal data and often fail to explain clearly how that data is collected and used. Privacy information was frequently overly technical and difficult to access. The ICO therefore expects organisations to provide concise, accessible privacy information in line with UK GDPR transparency requirements.

The report also highlights weaknesses in legitimate interests assessments, including insufficient analysis of the impact on individuals and limited evidence demonstrating the effectiveness of mitigating safeguards. In addition, developers continue to face challenges in responding to data subject rights requests where personal data cannot easily be identified within large training datasets. The ICO calls for clearer mechanisms for individuals to submit and track rights requests, particularly where personal data has been obtained indirectly.

Following engagement with the ICO, several major foundation model developers have improved, or committed to improve, transparency measures, legitimate interests assessments and rights-request processes.

Alongside the report, the ICO has launched a call for evidence on the data protection risks posed by agentic AI, signalling what is likely to be the regulator’s next major area of focus.