The Information Commissioner’s Office warned developers of large language models that they need a lawful basis for processing personal data, and that no excuse exists for ignoring privacy obligations.

The UK’s Information Commissioner’s Office (ICO) has issued a stark warning to developers of large language models (LLMs), insisting they must demonstrate a lawful basis before processing any personal data.

Legal obligations under UK data protection law

Under the UK General Data Protection Regulation (UK GDPR), any processing of personal data requires a clear legal justification, such as consent, legitimate interests, or performance of a contract. The ICO stresses that the scale and sophistication of AI training do not exempt developers from these duties.

No blanket exemptions for AI training

The regulator rejects the argument that using publicly available text, images, or code for model training automatically qualifies as a permissible activity. Each dataset must be examined, and any personal identifiers must be handled in line with privacy principles.

Developers are also reminded that the ICO’s guidance on “data minimisation” and “purpose limitation” applies equally to AI. This means only the data strictly necessary for the model’s intended function should be retained, and it must not be repurposed without further justification.

Potential consequences of non‑compliance

Failure to meet the legal standards can trigger enforcement actions, including hefty fines, mandatory remediation, and reputational damage. The ICO has indicated it will scrutinise AI projects on a case‑by‑case basis, looking for evidence of due diligence and risk assessments.

  • Conduct a data protection impact assessment before training
  • Document the lawful basis for each data source
  • Implement robust anonymisation or pseudonymisation techniques
  • Maintain transparent records for regulator review

By embedding these safeguards early, AI developers can reduce the risk of regulatory breach and demonstrate a commitment to ethical data handling.

“AI model builders cannot hide behind the complexity of their systems to avoid basic privacy responsibilities,” the ICO said in its latest advisory.

The ICO’s stance aligns with broader European trends, where data protection authorities are increasingly focusing on the intersection of AI and privacy law.

Computer Weekly coverage of AI model developers and privacy law