ICO: AI does not invalidate personal data access requests

On 11 November 2026, the ICO published “Subject access requests generated by artificial intelligence”, guidance on requests for access to personal data drafted with AI assistance. The document covers Article 15 of the UK GDPR in the United Kingdom and explains the application of existing rules. A request remains valid if it is clear that the person wants access to their own data, even when it contains inaccurate information or incorrect legal references. Using AI does not justify different treatment or introduce specific exemptions.

The guidance explains that organisations must respond as soon as possible and within one month, starting upon receipt of the request and any necessary identity or authority documents, or a fee where requested. Complex requests may receive an extension of up to two further months, with the reasons explained to the requester. AI use, lengthy wording or the volume of information do not, by themselves, establish complexity: actual difficulties in locating, reviewing or disclosing data matter. Where reasonably necessary, clarification must be sought promptly and pauses the deadline until a response is received; organisations cannot, however, require the requester to narrow the request.

According to the ICO, searches must be reasonable and proportionate. Specifically requested metadata must be assessed to establish whether it is the requester’s personal data and searched for on that basis; a general request does not necessarily require searches of every metadata category. AI assistance also does not make a request manifestly unfounded or excessive. To refuse to respond, wholly or partly, or charge a reasonable fee on that basis, an organisation must be able to justify its decision in light of the circumstances. Practical recommendations include staff training and checking contact details, identity and representatives’ authority where doubts arise.