UK GDPR
AI memory and UK GDPR.
This page is not legal advice. It sets out, with dates, what applies to a tool that remembers you.
Last verified
Is an AI memory personal data?
Yes. A memory about you is personal data, so the ordinary rules apply: a lawful basis for holding it, a route to see it, correct it and delete it, and a named list of who processes it.
What rights do I actually have?
Access, rectification, erasure, portability and objection. In practice the ones that bite are seeing what is held, correcting it, and getting it out in a form you can use elsewhere.
Where does the EU AI Act stand?
It is in force, and the obligations arrive in stages. The dated position, including the deferral adopted in July 2026, is set out below.
Does the EU AI Act apply to a UK product?
Where a product is used by people in the EU, yes. AI Twin serves EU users, so we build to the Act's transparency duties rather than wait to be asked. The UK has no equivalent statute today; the ICO, the CMA and the FCA apply existing law to the same conduct.
The UK position
The Data (Use and Access) Act received Royal Assent on 19 June 2025. Its first provisions came into force on 20 August 2025, and the automated decision-making provisions on 1 December 2025.
Verified . Primary source.
The ICO opened a consultation on automated decision-making and profiling guidance in March 2026, which closed in May 2026, with final guidance expected in summer 2026. On 29 May 2026 the ICO said its 2026/27 work includes an AI code of practice and dedicated agentic AI guidance. Its existing guidance on AI and data protection remains non-statutory.
Verified . Primary source.
The EU AI Act timeline
The EU AI Act came into force on 1 August 2024. Prohibited practices and AI literacy obligations applied from 2 February 2025. General-purpose AI model obligations applied from 2 August 2025.
Verified . Primary source.
Under the Act as originally passed, most high-risk obligations, the Article 50 transparency duties and the penalty regime were set to apply from 2 August 2026.
Verified . Primary source.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and came into force on 27 July 2026. It moves the Annex III high-risk obligations to 2 December 2027 and the Annex I obligations to 2 August 2028. The Article 50 transparency duties still apply from 2 August 2026. A transition to 2 December 2026 for machine-readable marking of AI-generated content covers only systems already on the EU market before 2 August 2026.
Verified . Primary source: Regulation (EU) 2026/1744 on EUR-Lex, and the European Commission's notice of entry into force on 27 July 2026.
How we hold ourselves to it
Built to UK GDPR and EU AI Act standards.
Our trust commitments, who processes your data, how we use AI, and how output is labelled and how to get your data out.