Data Privacy & AI

AI

The 2025 King’s Speech said that the Government would “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models” – this is not included in the ERA 2025 but had been originally anticipated as a separate AI Bill.

The Plan to Make Work Pay also included some comments about AI in the workplace, saying:

• It recognises the importance of new technologies including AI but that it sees that it can also pose risks to jobs and livelihoods;

• It wants to ensure rights and protections keep pace with technological change, safeguard against discrimination and put the worker voice at the heart of digital transition;

• It would work with workers and unions to safeguard against the invasion of privacy through surveillance technology, spyware and discriminatory algorithmic decision making; and

• At a minimum, it will ensure that proposals to introduce surveillance technologies would be subject to consultation and negotiation, with a view to agreement of trade unions or staff representatives

On 8 July 2026, the Government launched a consultation seeking views on proposals to support the fair, transparent and responsible use of workplace monitoring technologies, in line with the commitments. (See the Collective Bargaining and Trade Unions sections for more information).

The Government may perhaps look to the TUC’s draft AI Bill for inspiration for any domestic rules here on the use of AI systems by employers in relation to workers, employers and jobseekers.  

Since the Plan to Make Work Pay’s publication, there have been some developments to AI (although not all directly employment-related) which demonstrate the Government’s changing position in respect of AI, but which overall appears to prioritise flexibility, economic growth and a light-touch stance to regulation, over a strict legislative approach. Such broader developments , which may not directly impact employers include: 

• On 5 September 2024 the Government and the EU announced their signature of an international convention in respect of Artificial Intelligence and Human Rights, Democracy and the Rule of Law.  As part of the Government’s announcement on this, it confirmed that it will work closely with regulators, the devolved administrations, and local authorities as the convention is ratified to ensure it can appropriately implement the new requirements.
• In December 2024, the Government launched a consultation relating to AI and copyright (now closed), which included consideration on the regulation of deep fakes, transparency of AI systems and labelling of generative AI outputs. The aim of the consultation was to set out the “plan to deliver a copyright and AI framework that rewards human creativity, incentivises innovation and provides the legal certainty required for long-term growth in both sectors” – clearly seeking to balance innovation and regulation. Copyright was a contentious topic during the passing of the Data (Use and Access) Act 2025. In the final text, provisions were included which require the Government to show its progress. The Government published a report on 18 March 2026 in response to the consultation, setting out its proposed approach in respect of copyright reform, which is largely to continue monitoring and working with partners to consider if legislation change is required.
• On 13 January 2025, the Government published its AI Opportunities Action Plan, with which it hopes to “position the UK to be an AI maker”. This action plan re-iterates the Government’s “pro-innovation” approach to regulation, which it considers “a source of strength”.
• In February 2025 the UK (along with the US) refused to sign a declaration on the international AI statement at the global AI summit in Paris. However, it did sign up to other global initiatives including the Coalition for Sustainable AI. 
• Press reports from late February 2025, also indicated that the Government’s plans to introduce an AI Bill “to place requirements on those working to develop the most powerful artificial intelligence models”, is on hold (or dropped) in a potential alignment with the US’s stated position at that time. 
• In October 2025, the Department for Science, Innovation and Technology announced that it plans to establish controlled testing environments, “AI Growth Labs”, to allow key sectors (e.g. healthcare, professional services, transport and manufacturing) to test and develop AI tools under relaxed regulatory rules but with strict supervision to encourage innovation within secure settings. A call for evidence was open until 7 January 2026.
• The new DUA Act relaxes the existing restrictions on automated decision-making where appropriate safeguards are in place. The existing rules on solely automated decision making remain in relation to special category data. The relevant provisions came into force on 5 February 2026.
• On 10 March 2026, the Government opened an inquiry into AI, business and the future of the workforce. The call for evidence was open until 3 April 2026.
• The 2026 King’s Speech mentioned a new Regulating for Growth Bill to create “sandboxing powers” to enable controlled trials where existing laws can be modified or suspended to allow experimentation in relation to technologies such as AI. The background briefing notes give the example of “exploring cross-cutting AI sandboxes, enabling responsible testing and adoption of AI-enabled products and services across multiple sectors where existing regulatory frameworks currently slow innovation”.

Data Privacy

As mentioned above, the DUA Act separately makes reforms in respect of data privacy and AI that, although not necessarily linked to the Plan to Make Work Pay, may be of interest to employers.  

Although much of the DUA Act is not employment related, there are some key changes that are of note from an employment perspective, including:  

• Introducing an exhaustive list of “recognised legitimate interests” on which businesses can rely by default as a lawful ground for processing ordinary personal data, although in practice this is unlikely to make a significant practical difference to employers as the list is quite narrow. It also introduces a non-exhaustive list of examples of types of processing that may be considered necessary processing for the purposes of a legitimate interest to assist businesses, although employers will still need to complete a balancing exercise. The ICO has published new guidance on recognised legitimate interests to reflect these amendments. 
• Relaxing the test for data transfers to third countries where the standard of protection is “not materially lower” than that of the UK. 
• Clarifying the principles relating to DSARs (specifically in respect of timing, extensions and stopping the clock) and codifying in legislation the principle that individuals are only entitled to information that the employer is able to provide based on a “reasonable and proportionate search.” 
• Introducing a new right to complain so that individuals may make a complaint directly to their employer if they consider there has been a breach of UK data privacy laws in respect of their personal data, and employers must facilitate these complaints by the provision of a complaints form, whether electronically or otherwise. 
• Replacing the ICO with the Information Commission and clarifying its extended powers.  
• As mentioned above, relaxing the restrictions on automated decision-making, which were previously based on a general prohibition with limited exceptions. The DUA Act narrows the restriction on automated decision making to only significant decisions based entirely or partly on processing of special category data (such as health or racial/ethnic origin). This opens up the possibility for UK employers to be able to lawfully rely on automated decision-making in a broader set of circumstances. Unless one of the specified conditions for authorisation are met. The DUA Act also provides for additional safeguards which employers are required to put in place. The ICO was consulting on draft guidance about automated decision making, including profiling, until 29 May 2026.

To understand more about the changes, please read our article here.  

Note that the EU-UK adequacy decision on data transfers (allowing for the transfer of data between the EU and the UK) has been renewed for six years to 27 December 2031.

In addition, regulations came into force on 12 May 2026 requiring the Information Commissioner to prepare a code of practice giving guidance on good practice in the processing of personal data in relation to developing and using AI and automated decision making.

---

Timing and developments

AI

Partly mentioned in King’s Speech. To be considered further in the AI Opportunities Action Plan. Small changes to automated decision-making in the DUA Act. AI Bill reported to largely be on hold. The call for evidence on AI, business and the future of the workforce was open until 3 April 2026. The Government also published a consultation on use of workplace monitoring technologies on 8 July 2026, which closes on 30 September 2026.

Data privacy

The DUA Act passed on 19 June 2025. The provisions have been coming into force on a phased basis, for example that DSARs need only be based on a reasonable and proportionate search is treated as coming into force on 1 January 2024 and additional provisions came or are coming into force from 17 November 2025, 5 February 2026 and 19 June 2026. The provisions which came into force on 5 February 2026 include the introduction of “recognised legitimate interest” as a new lawful basis, a new data protection test for transferring personal data to third countries and international organisations, and enhanced powers of the Information Commissioner’s Office. The new right to complain is due to take effect on 19 June 2026.