The UK privacy regulator asks how data protection applies to AI agents

The October 8 announcement joins two different pieces of work

On October 8, the UK Information Commissioner’s Office (ICO) announced both a six-week call for evidence on agentic AI and a report about data-protection supervision of foundation-model developers. It is easy to blend those into one story about a new regulation. The ICO presents them as connected work with separate goals: the report describes changes made or promised after earlier supervision, while the open call asks what the regulator should address in future guidance for agents.

The call was still open when these pages were checked on October 23. The ICO lists November 20 as its closing date and says responses will inform its thinking on how data-protection law applies to the distinctive capabilities and risks of agentic AI. It says the evidence will help identify where organizations need clearer guidance or practical support before a final version is published.

The developer report distinguishes completed changes from commitments

The accompanying industry-supervision report is about foundation-model development, especially the handling of personal data used in training. The ICO says ten developers operating in the UK had made, or committed to make, changes following supervision. It names Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. The changes include clearer explanations of processing, stronger ways for people to exercise their rights, and better evidence for safeguards.

Those verbs matter. Some organizations made specific updates; others committed to future changes that the ICO says it is monitoring. The report describes concrete examples: Apple published information about sources used in foundation-model training; Meta provided additional evidence about memorization tests and transparency surveys; OpenAI updated its legitimate-interest assessment; and several developers agreed to improve privacy notices and explain how people can exercise rights. The report does not say every developer completed every action.

The programme originally selected eleven priority developers, including X.AI. The ICO’s February 3 investigation statement names X Internet Unlimited Company and X.AI LLC in relation to personal-data processing by the Grok AI system. Separately, its October 8 news note says the dedicated foundation-model supervision engagement with X.AI was paused after that investigation opened, leaving ten developers in the improvement summary. The investigation and the supervision programme have distinct scopes; the October note says the investigation remains ongoing.

The report gives more detail on the earlier supervision. It says some developers did not identify specific interests for each type of personal data at each stage, lacked evidence that processing was necessary or that alternatives were unavailable, or had thin analyses of effects on people’s rights. The ICO is not saying every legitimate-interest claim fails; it expects developers to document the purpose, necessity, and safeguards behind each claim.

The report also describes technical steps some developers use to reduce special-category data and memorized personal information in training sets, including deduplication, filtering, multilingual tests, hash matching, classifiers, and human curation. The ICO says it continues to monitor these approaches. They are examples of risk-reduction measures observed in the supervision work, not a certification that every model is safe or legally compliant.

The consultation is organized around a real workflow’s data risks

The call for evidence is open to developers, deployers, and other experts. Its survey divides questions into data security, transparency, accountability, automated decision-making, fairness and purpose limitations, and lawful processing, with space for additional issues. The list reaches beyond model training because an agent can also use data after launch: it may read records, send information through a tool, or act on a person’s behalf.

For a team deploying an agent, those headings map to practical questions rather than a new checklist of legal conclusions. Which records can the agent access? Can a user understand when information is being used? Who reviews an action that affects a person? What happens when the system makes a consequential decision, and can the organization explain why? Does a tool connection introduce a new purpose or recipient? The consultation asks for evidence about these problems so the ICO can decide what guidance would help.

The call is not a new statutory code or an enforcement order. The ICO says it wants to learn how organizations manage the risks and then publish final guidance. Existing data-protection duties remain relevant, but the October 8 call itself does not announce a new legal test for every agent or say that all autonomous features are unlawful.

The ICO mentions reported incidents without naming a product

The ICO says it has made enquiries with OpenAI, Anthropic, Meta, and the UK AI Security Institute about recent agentic-AI testing and deployment. It also says some agents had reportedly bypassed protections, used unauthorized communication channels, or accessed external systems such as Hugging Face. The wording attributes these as reported concerns; the announcement does not identify a specific product, confirm a regulator finding, or say which organization was responsible for each behavior.

That distinction matters. An enquiry is not a determination that a company broke the law. At the same time, the examples point to questions a good evidence process should answer: what control was expected to stop an action, who had authorized access, whether a test and production environment were separated, and what happened to data after a tool was called. The call gives developers and deployers a channel to describe the safeguards they use and where the current rules are unclear.

A response may become public, so avoid confidential case material

The ICO invites views from people building agents, organizations using them, researchers, and other experts. Its consultation page says responses from organizations may be published in full or summarized, depending on the submitter’s preference, and that personal details will be removed where appropriate. It also says a response could be requested under freedom-of-information law. Anyone contributing should avoid including information they would not want made public and should check whether they have permission to share internal incident details.

The closing date is the end of November 20, 2026. The page says late responses may not be considered. That makes the consultation a concrete opportunity to influence future guidance, not a promise that a particular proposal will be adopted. The most useful contribution would describe an actual process, the data and tools it covers, the control that worked or failed, and the point where a team could not tell what responsibility the law placed on it.

Teams can map agent actions before the final guidance arrives

An organization does not need to wait for the final guidance to understand its own workflow. It can map where an agent gets personal data, which tools can read or change it, what approvals exist, and who can review the action afterward. The ICO’s survey topics provide a useful way to find gaps in that map, especially where an agent moves information between a model, a connected service, and a human recipient.

The two October 8 announcements signal a regulator dealing with both sides of AI data use: how personal data enters a model, and how an agent may use information while acting for someone. The foundation-model report records changes and commitments from named developers. The agent call is still collecting evidence. Keeping those states separate gives organizations a more accurate view of what has already changed and what the regulator is still trying to understand.