AI agents and UK data protection law: ICO sets out its expectations and calls for views

On 8 October 2026, the UK Information Commission’s Office (ICO), which regulates privacy law in the UK, opened a call for evidence on how organisations are managing the data protection risks of agentic AI. 

AI agents are systems that complete tasks, use tools and interact with websites, often autonomously and with limited human oversight. As part of the call for evidence, the ICO’s Director of Technology Regulation said: “the fact AI agents act with autonomy is not an excuse for poor compliance.” The call is built around six themes, each being an area where the ICO found organisations struggling with a lack of clarity on how to apply data protection laws to agentic AI and on which the ICO sets out its current expectations. 

The call for evidence closes on 20 November 2026, and the responses will shape future ICO guidance and its forthcoming statutory code of practice on AI and automated decision-making. 

In this blog post, we look at what the ICO says it expects from organisations using AI agents across the six themes and set out practical steps they can take now.

Security: control what the agent can do

Agents can act autonomously without direction or sign-off from a human at each step. The ICO points to an example of an agent that might retrieve external information and update an internal database on its own. The ICO states that this raises “the risk that security failures or malicious instructions” could “spread across connected systems”, and expects the level of autonomy given to agents to be a “deliberate” design choice, backed by guardrails, permissions and approval thresholds proportionate to the risk of what an agent can do with personal data. This means that existing security principles under the UK GDPR will continue to apply to agents, but relevant controls must be designed by organisations to account for what an agent can access and do.

Measures such as least-privilege access, limits on tool use and human approval for high-risk actions are cited by the ICO as emerging approaches to manage agents (and they will be familiar to many organisations), but the ICO is clear that they must actively govern what an agent can access, which tools it uses and what actions it takes. 

The ICO states that organisations will need “a clear way to identify when an agent is operating” to enable appropriate guardrails, and introduces a concept of agentic “ownership”, suggesting that deployers of agents register each agent to an owner, and give it a set purpose and set of permissions and capabilities. 

Transparency: explaining a moving target

An agent may gather information from a device, internal systems, screenshots or external tools. It may then share that information with other agents or third parties, send emails or make purchases. The processing can vary extensively, and sources and recipients of data can change every time its workflow runs. The ICO suggests that this can challenge individuals’ ability to understand an agent’s processing activities, and questions whether a general explanation before a workflow begins is enough to satisfy transparency obligations under the UK GDPR. The ICO accepts that additional transparency measures - prompts, notifications and approval steps as the workflow continues – may add “friction” to the user experience, but suggests that this may be necessary to ensure compliance. 

The ICO also points out that data protection law is not the only relevant regime. If an agent stores information on a person’s device, or accesses information already stored there, the Privacy and Electronic Communications Regulations 2003 (PECR) may apply, and regulation 6 requires organisations to give “clear and comprehensive information” about why that storage or access is happening.

Accountability: who is the controller?

It can be difficult to identify the relevant controller(s) and processor(s) across the AI supply chain, given the number of potential parties involved as suppliers of models, agents and tools. The ICO notes that it has seen some developers say they are controllers only for initial development, maintenance and security, and try to say that parties in other parts of the value chain are controllers for downstream activities. The ICO’s response is that organisations should “interpret the concept of a controller broadly to ensure complete and effective protection for people”, and that decisions about protocols, permissions and access controls may indicate a determination of the means of processing, meaning that whoever sets them may take on controller responsibilities.

Automated decision-making: look at the whole workflow

Agents can make a set of decisions that together produce an outcome with “significant” effects on a person, without “meaningful human involvement”. The ICO notes that this can bring agentic AI systems in-scope of the UK GDPR’s automated decision-making provisions. Organisations must assess whether those provisions apply across the whole agentic workflow, not just to a single decision; human input at one point in a chain of machine decisions will not necessarily be meaningful human involvement. The ICO recommends that the reviewer should have the authority to change the outcome, have enough training to understand the “logic, outputs, limitations and risks” in the system, and should weigh the different factors the system relied on when intervening. 

If an agent behaves unexpectedly, organisations should be able to reconstruct what happened. Here, the ICO points to logging as a way of addressing this, in addition to ensuring that humans are involved in any “critical moments” in the decision-making process.

Fairness and purpose limitation: new uses need justification

As part of a workflow, agents may take intermediate steps that no human user specifically asked for, and may reuse information, including personal data, from one task in another. The ICO is clear that an agent’s ability to spot a new use for personal information does not make that use compatible with the original purpose. It also warns that simply labelling a product development process as “research” will not necessarily bring it within the scientific research provisions that allow for reuse of personal data for different purposes, and states that processing solely for “internal, commercial product development” is unlikely to qualify. 

This approach is perhaps more nuanced than the ICO’s February 2026 updated guidance on scientific research, which states that training by a company “only” to train its AI algorithm “to make better decisions in future” (e.g. to reduce bias) can qualify as scientific research. UK data protection law also expressly recognises that scientific research can be a commercial activity. Following a consultation, the ICO plans to publish further updated guidance on scientific research this autumn. It remains to be seen whether this will clarify the position on AI model training or distinguish between agentic AI and conventional generative AI.

Lawful basis: one size does not fit all

The ICO states that neither the terms of service or contract between provider and user, nor a user’s instruction to an agent, provides a lawful basis under the UK GDPR for all processing by an agent that may follow. For example, the contractual basis applies only where processing is objectively necessary to deliver the service the user asked for, and the ICO notes that different stages of a workflow may need different lawful bases. Legitimate interests may be available, for example for training orchestrator large language models, but only if a legitimate interests assessment is in place. 

The ICO also notes that, where an agent accesses or stores information on a user’s device, PECR may apply, which may mean providers and deployers of agents need user consent for that activity, in addition to or alongside any other applicable lawful bases. 

Key messages

Across the six themes, the ICO focuses on the importance of organisations being able to identify the actions of a particular agent, the authority it operated under, and the data it used. Agent identification, clearly defined permissions, tracing and logging all feature in the ICO’s expectations on security, transparency, accountability, automated decision-making and purpose limitation.

The call for evidence also accompanies closer ICO scrutiny of agentic AI. Alongside the call for evidence, the ICO confirmed that it had made enquiries with certain frontier AI labs and the UK’s AI Security Institute. The ICO says that this engagement followed allegations that some agents had bypassed protections, used unauthorised communication channels and accessed external systems.

What should organisations do now?

This call for evidence provides an initial view of how the ICO expects to regulate agentic AI in the future and, as such, offers a helpful starting point for what organisations should start to think about. Some compliance steps organisations may wish to consider are: 

• Mapping each agentic workflow from start to finish, including every data source, tool and recipient.
• Keeping an inventory of agents and their permissions, with a named owner and purpose for each.
• Checking whether logs provide enough detail to reconstruct decisions, including where and how people intervened.
• Revisiting any assessment made on whether the organisation is a controller or processor for agentic AI activities.
• Testing lawful basis and purpose compatibility at each stage of a workflow, not just at the start. 

For more details on Freshfields’ AI practice, visit: Artificial intelligence | Freshfields