UK GDPR
AI memory and UK GDPR.
This page is not legal advice. It sets out, with dates, what applies to a tool that remembers you.
Last verified
Is an AI memory personal data?
Yes. A memory about you is personal data, so the ordinary rules apply: a lawful basis for holding it, a route to see it, correct it and delete it, and a named list of who processes it.
What rights do I actually have?
Access, rectification, erasure, portability and objection. In practice the ones that bite are seeing what is held, correcting it, and getting it out in a form you can use elsewhere.
Where does the EU AI Act stand?
It is in force, and the obligations arrive in stages. The dated position, including the proposed deferral, is set out below.
The UK position
The Data (Use and Access) Act received Royal Assent on 19 June 2025. Its first provisions came into force on 20 August 2025, and the automated decision-making provisions on 1 December 2025.
Verified . Primary source.
The ICO opened a consultation on automated decision-making and profiling guidance in March 2026, which closed in May 2026, with final guidance expected in summer 2026. On 29 May 2026 the ICO said its 2026/27 work includes an AI code of practice and dedicated agentic AI guidance. Its existing guidance on AI and data protection remains non-statutory.
Verified . Primary source.
The EU AI Act timeline
The EU AI Act came into force on 1 August 2024. Prohibited practices and AI literacy obligations applied from 2 February 2025. General-purpose AI model obligations applied from 2 August 2025.
Verified . Primary source.
Under the Act as originally passed, most high-risk obligations, the Article 50 transparency duties and the penalty regime apply from 2 August 2026.
Verified . Primary source.
A provisional political agreement reported on 7 May 2026, known as the Digital Omnibus, would defer the Annex III high-risk obligations to 2 December 2027 while leaving 2 August 2026 in place for Article 50 transparency, general-purpose AI penalties and market surveillance. This is not yet final law.
Verified . Third-party reporting.
How we hold ourselves to it
Built to UK GDPR and EU AI Act standards.
Our trust commitments, who processes your data and how to get your data out.