UK GDPR
AI memory and UK GDPR.
Last verified
Is an AI memory personal data?
Yes. A memory about you is personal data, so the ordinary rules apply: a lawful basis for holding it, a route to see it, correct it and delete it, and a clear account of who processes it.
What rights do I actually have?
Access, rectification, erasure, portability and objection, among others. In practice the ones that bite are seeing what is held, correcting it, and getting it out in a form you can use elsewhere.
Where does the EU AI Act stand?
It is in force, and the obligations arrive in stages. The dated position, including the deferral adopted in July 2026, is set out below.
Does the EU AI Act apply to a UK product?
Where a product is used by people in the EU, yes. AI Twin serves EU users, so we build to the Act's transparency duties rather than wait to be asked. The UK has no equivalent statute today; the ICO, the CMA and the FCA apply existing law to the same conduct.
The UK position
The Data (Use and Access) Act received Royal Assent on 19 June 2025. Its first provisions came into force on 20 August 2025. Most of its data protection changes, including the reformed rules on automated decision-making, came into force on 5 February 2026. The right to complain to an organisation first applied from 19 June 2026.
Verified . Primary source.
The ICO consulted on draft guidance on automated decision-making and profiling from 31 March to 29 May 2026. The final guidance has not yet been published; the ICO expects to publish it in winter 2026. Its existing guidance on AI and data protection remains non-statutory.
Verified . Primary source.
The EU AI Act timeline
The EU AI Act came into force on 1 August 2024. Prohibited practices and AI literacy obligations applied from 2 February 2025. General-purpose AI model obligations applied from 2 August 2025.
Verified . Primary source.
Under the Act as originally passed, most high-risk obligations, the Article 50 transparency duties and the penalty regime were set to apply from 2 August 2026.
Verified . Primary source.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and came into force on 27 July 2026. It moves the Annex III high-risk obligations to 2 December 2027 and the Annex I obligations to 2 August 2028. The Article 50 transparency duties still apply from 2 August 2026. A transition to 2 December 2026 for machine-readable marking of AI-generated content covers only systems already on the EU market before 2 August 2026.
Verified . Primary source: Regulation (EU) 2026/1744 on EUR-Lex, and the European Commission's notice of entry into force on 27 July 2026.
How we hold ourselves to it
Built to UK GDPR and EU AI Act standards.
Our trust commitments, who processes your data, how we use AI, and how output is labelled and how to get your data out.