Data Privacy & AI

Policy

AI

The King’s Speech said that it will “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models” – this is not included in the Employment Rights Bill but has been anticipated in as a separate AI Bill.

The Plan to Make Work Pay, also included some comments about AI in the workplace, saying:

• it recognises the importance of new technologies including AI but that it sees that it can also pose risks to jobs and livelihoods;

• it wants to ensure rights and protections keep pace with technological change, safeguard against discrimination and put the worker voice at the heart of digital transition;

• it would work with workers and unions to safeguard against the invasion of privacy through surveillance technology, spyware and discriminatory algorithmic decision making; and

• at a minimum, it will ensure that proposals to introduce surveillance technologies would be subject to consultation and negotiation, with a view to agreement of trade unions or staff representatives (see the Collective Bargaining and Trade Unions section).

The Government may perhaps look to the TUC’s draft AI Bill for inspiration for any domestic rules here on the use of AI systems by employers in relation to workers, employers and jobseekers.  

Since the King’s Speech and the Plan to Make Work Pay’s publication, there have been some developments to AI (although not all directly employment-related) which demonstrate the Government’s changing position in respect of AI, but which overall which appears to prioritise flexibility, economic growth and a light-touch stance to regulation, over a strict legislative approach. Such developments include: 

• On 5 September 2024 the Government and the EU announced their signature of an international convention in respect of Artificial Intelligence and Human Rights, Democracy and the Rule of Law.  As part of the Government’s announcement on this, it confirmed that it will work closely with regulators, the devolved administrations, and local authorities as the convention is ratified to ensure it can appropriately implement the new requirements.
• In December 2024, the Government launched a new consultation relating to AI and copyright (now closed), which included consideration on the regulation of deep fakes, transparency of AI systems and labelling of generative AI outputs. The aim of the consultation is to set out the “plan to deliver a copyright and AI framework that rewards human creativity, incentivises innovation and provides the legal certainty required for long-term growth in both sectors” – clearly seeking to balance innovation and regulation. Copyright was a contentious topic during the passing of the Data (Use and Access) Act 2025. In the final text, provisions were included which require the Government to show its progress. 
• On 13 January 2025, the Government published its AI Opportunities Action Plan, with which it hopes to “position the UK to be an AI maker”. This action plan re-iterates the Government’s “pro-innovation” approach to regulation, which is considers “a source of strength”.
• In February 2025 the UK (along with the US) refused to sign a declaration on the international AI statement at the global AI summit in Paris. However, it did sign up to other global initiatives including the Coalition for Sustainable AI. 
• Press reports from late February 2025, also indicated that the Government’s plans to introduce an AI Bill “to place requirements on those working to develop the most powerful artificial intelligence models”, is on hold (or dropped) in a potential alignment with the US’s stated position at that time. 
• As a final note, the new DUA Act once the relevant provisions are in force will relax the restrictions on automated decision-making resulting in the restrictions only applying in relation to special category data.  

Data Privacy

As mentioned above, the DUA Act separately makes reforms in respect of data privacy and AI that, although not necessarily linked to the Plan to Make Work Pay, may be of interest to employers.  

Although much of the DUA Act is not employment related, there are some key changes that are of note from an employment perspective, including:  

• Introducing an exhaustive list of “recognised legitimate interests” on which businesses can rely by default as a lawful ground for processing ordinary personal data, although in practice this is unlikely to make a significant different as the list is quite narrow. It also introduces a non-exhaustive list of examples of types of processing that maybe considered necessary processing for the purposes of a legitimate interest to assist businesses, although employers will still need to complete a balancing exercise.  
• Relaxing the test for data transfers to third countries where the standard of protection is “not materially lower” than that of the UK. 
• Clarifying the principles relating to DSARs (specifically in respect of timing, extensions and stopping the clock) and codifying in legislation the principle that individuals are only entitled to information that the employer is able to provide based on a “reasonable and proportionate search.” 
• Introducing a new right to complain so that individuals may now make a complaint directly to their employer if they consider there has been a breach of UK data privacy laws in respect of their personal data, and employers must facilitate these complaints by the provision of a complaints form, electronically or otherwise. 
• Replacing the ICO with the Information Commission and clarifying its extended powers.  
• As mentioned above, relaxing the restrictions on automated decision-making, which are currently based on a general prohibition with limited exceptions. The DUA Act narrows the restriction on automated decision making to only significant decisions based entirely or partly on processing of special category data (such as health or racial/ethnic origin). This opens up the possibility for UK employers to be able to lawfully rely on automated decision-making in a broader set of circumstances. This is unless one of the specified conditions are met. The DUA Act also provides for additional safeguards which employers are required to put in place. 

To understand more about the changes, please read out article here.  

Note that the EU-UK adequacy decision on data transfers (allowing for the transfer of data between the EU and the UK) was due to expire on 27 June 2025, but has been extended by six months to 27 December 2025. The EU will need to reconfirm that the UK continues to provide an equivalent level of data protection as the EU. Whether or not the changes undermine the UK’s adequacy status, remains to be seen. If adequacy status is not renewed in December, this could result in companies needing to implement alternative measures to transfer data from the EU to the UK, but this has not been confirmed.  

---

Timing and developments

AI

Partly mentioned in King’s Speech. To be considered further in the new consultation and AI Opportunities Action Plan. Small changes to automated decision-making in the DUA Act. AI Bill reported to largely be on hold.

Await developments on key reforms.

Data privacy

The DUA Act passed on 19 June 2025. Some minor provisions are already in force, for example that DSARs need only be based on a reasonable and proportionate search is treated as coming into force on 1 January 2024. The majority of the provisions, however, will need to be brought into force via commencement regulations, and are anticipated being phased in between the Act passing and June 2026. 

EU-UK adequacy decision due for renewal on 27 December 2025.