The ICO exists to empower you through information.

This consultation has closed

We are launching a consultation series on how aspects of data protection law should apply to the development and use of generative AI models.

Generative AI refers to AI models that can create new content eg text, computer code, audio, music, images, and videos. Typically these models are trained on extensive datasets, which allows them to exhibit a broad range of general-purpose capabilities.

The impact of generative AI could be transformative for people and businesses if organisations develop and deploy it responsibly with the trust of the people whose data it is built on. We are moving fast to address any risks and enable organisations and the public to reap the benefits of generative AI.

New technology, new questions

Our engagement with innovators has highlighted several areas where organisations would welcome further clarity on how data protection law applies to the development and use of generative AI.

As generative AI is developed and deployed in ways that are distinct from simpler AI models used for classification or prediction objectives, this raises new questions.

These include:

  • what is the appropriate lawful basis for training generative AI models?
  • how does the purpose limitation principle play out in the context of generative AI development and deployment?
  • what are the expectations around complying with the accuracy principle?
  • what are the expectations in terms of complying with data subject rights?

Our consultation series

Over the coming months, we will share a series of chapters to outline our emerging thinking on how we interpret specific requirements of UK GDPR and Part 2 of the DPA 2018 in relation to these questions.

We invite all stakeholders with an interest in generative AI to respond and help inform our positions. This includes developers and users of generative AI, legal advisors and consultants working in this area, civil society groups and other public bodies with an interest in generative AI.

We will use the input received to update our guidance on AI and other products.

Chapter one: The lawful basis for web scraping to train generative AI models

Our first chapter covers the lawful basis for training generative AI models on web-scraped data and is open until 1 March 2024. You can let us know your thoughts on the chapter online or via email at [email protected].

Chapter two: Purpose limitation in the generative AI lifecycle

Our second chapter covers how purpose limitation should be applied at different stages in the generative AI lifecycle and is open until 12 April 2024. You can let us know your thoughts on the chapter online or via email at [email protected].

Chapter three: Accuracy of training data and model outputs

Our third call for evidence focuses on how the accuracy principle applies to the outputs of generative AI models, and the impact that the accuracy of training data has on the output. It is open until 10 May 2024. You can let us know your thoughts on the chapter online or via email at [email protected].

Chapter four: Engineering individual rights into generative AI models

Our fourth call for evidence focuses on individual rights - the information rights data protection confers to people over their personal information - and in particular in relation to the training and fine-tuning of generative AI. It is open until 10 June 2024. You can let us know your thoughts on the chapter online or via email at [email protected].

Chapter five: Allocating controllership across the generative AI supply chain

Our fifth call for evidence focuses on the allocation of accountability for data protection compliance across the generative AI supply chain. It is open until 18 September 2024. You can let us know your thoughts on the chapter online or via email at [email protected].

Our work on AI

AI is a priority for the ICO. Our existing guidance on AI explains how to apply the concepts of data protection law when developing or deploying AI and our AI toolkit helps organisations identify and mitigate risks during the AI lifecycle.

Our guidance on AI applies equally to generative AI. In April 2023, we set out eight questions organisations developing or using generative AI that process personal data need to be asking themselves. In June 2023, we launched our Innovation Advice service which provides answers to AI innovators’ queries within 10-15 working days.

Read more about our work on AI.

Privacy statement

For this consultation we may publish a summary of the responses but will remove any personal data before publication. We will not publish responses from individuals. For more information about what we do with personal data please see our privacy notice.