Level 2: Personal Data and the UK GDPR Principles

General information, not legal advice. This course explains the law in plain terms. If you need advice on your own situation, speak to a qualified adviser. Legal points were checked against legislation.gov.uk and ICO guidance on 22 October 2026.

In Level 1 you saw where AI decisions show up in daily life: job applications, credit checks, insurance quotes and benefit claims. This level covers the rules that control what an organisation may do with your information before any decision is made. Three ideas are involved:

1. What counts as personal data.
2. The seven principles that apply to every use of it.
3. The lawful bases an organisation must have before it uses your data at all.

Task 1: Decide whether information is personal data

UK GDPR Article 4(1) defines personal data as any information relating to an identified or identifiable natural person. Someone is "identifiable" if they can be picked out directly or indirectly, for example from a name, an ID number, location data, an online identifier, or factors about their physical, economic, cultural or social identity.

AI matters here because AI systems produce new information about people. The ICO says that opinions and inferences (guesses or predictions about you) count as personal data if they relate to you and you can be identified. This applies whether or not the guess is correct. Some inferences, such as a predicted health condition, can be special category data, which gets extra protection.

What to do: for any piece of information, ask two questions.

1. Does it relate to me? Is it about me, or used to judge or affect me?
2. Can I be identified from it, on its own or combined with other data the organisation holds?

If the answer to both is yes, it is personal data.

Examples:

• Your name and email on a job application: yes.
• A "flight risk: 72%" score that an HR tool links to your employee ID: yes. It is an inference about you.
• A shopping app's label "likely pregnant" on your account: yes, and probably special category data.
• Truly anonymous national statistics that no one can trace back to you: no.

Task 2: Learn the seven principles (Article 5)

The principles work like the rules of the road: they apply to every journey your data takes. Here is each one with an AI example.

1. Lawfulness, fairness and transparency. There must be a legal basis, the use must not harm you unfairly, and you must be told what is happening. A retailer that secretly uses AI to set your prices from your browsing history is at risk here.
2. Purpose limitation. Data collected for one purpose should not be reused for an unrelated one. Wellbeing survey answers reused to train a redundancy-selection model.
3. Data minimisation. Use only what is adequate, relevant and necessary. A CV-screening tool that also scrapes candidates' social media.
4. Accuracy. Data must be accurate and kept up to date. An AI that mixes you up with someone else who has the same name.
5. Storage limitation. Do not keep identifiable data for longer than needed. Interview video recordings kept indefinitely "to improve the model".
6. Integrity and confidentiality (security). Protect data against loss, leaks and misuse. Customer chats pasted into a public AI tool.
7. Accountability. The organisation must comply and be able to show that it complies (Article 5(2)).

What to do: when an AI use worries you, go through the list and note which principle seems to be under strain. You will use those notes in later levels.

Task 3: Check the lawful basis (Article 6)

Processing is lawful only if at least one basis in Article 6(1) applies:

• (a) Consent: you agreed for a specific purpose.
• (b) Contract: it is needed for a contract with you, or steps you asked for before one.
• (c) Legal obligation: the law requires it.
• (d) Vital interests: it is needed to protect someone's life.
• (e) Public task: it is needed for a task in the public interest or official authority.
• (ea) Recognised legitimate interest: a newer basis, in force since 5 February 2026 under the Data (Use and Access) Act 2025. It covers a set list of purposes such as crime prevention, public security, safeguarding and emergencies.
• (f) Legitimate interests: the organisation's interests, balanced against your rights and freedoms.

Public authorities carrying out their tasks cannot rely on (ea) or (f). They usually rely on public task or legal obligation.

What to do:

1. Read the organisation's privacy notice and find the lawful basis it gives for the AI use.
2. Ask whether that basis fits. Is the processing really necessary for your contract? Did you actually consent?
3. If no basis seems to fit, write it down. That is a possible breach.

Template: asking which lawful basis applies

Subject: Lawful basis for processing my personal data

Dear [Organisation], I understand you use [describe tool, e.g. an automated scoring system] in connection with my [account/application/employment]. Please tell me: (1) what personal data about me, including any scores or inferences, this uses; (2) the purpose; and (3) the lawful basis under UK GDPR Article 6 that you rely on. Yours faithfully, [Name, reference number]

Checklist

• Does the information relate to me, and can I be identified from it?
• Are there scores, profiles or inferences about me?
• Which of the seven principles might be strained?
• What lawful basis does the privacy notice state?
• Does that basis actually fit, or does none apply?

Key takeaways

• Personal data is any information relating to an identified or identifiable person, and that includes AI scores, profiles and inferences, even wrong ones.
• Article 5 sets seven principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
• Every use of personal data needs an Article 6 lawful basis. Recognised legitimate interests has been available since 5 February 2026.
• Public authorities cannot rely on legitimate interests or recognised legitimate interests for their tasks.
• If no lawful basis fits, note it, because it may be a breach.