Context
What happened, and why it matters
Before a person starts, explain that the system uses AI, what it is intended to do, what information should not be entered and how to reach a person. If the conversation is stored or used for improvement, say so clearly.
The controller still needs a lawful basis and retention rule. Consent is not automatically the right basis for every chatbot; the correct assessment depends on purpose and context.
If a provider processes data outside the UK or uses conversations for model improvement, the organisation must understand the actual contract and settings rather than assume the consumer product terms apply.
Separate the announcement from the outcome
The named source explains what its publisher announced or recommended. It does not guarantee availability, suitability or results for every organisation.
Check the current primary source
Confirm dates, account eligibility, contractual terms and current documentation before changing a live service. Fast-moving products may differ from the version described here.
Use a controlled change
Define the intended result, owner and rollback route. Test with a limited scope, review evidence and document the decision before wider use.
Details
A useful way to read the update
| Question | Notice should answer |
|---|---|
| Who? | The organisation responsible and relevant providers |
| Why? | The defined purpose of the conversation |
| What? | Messages, contact details, metadata and optional fields |
| How long? | Retention period or decision method |
| Choice? | Human route, rights and withdrawal where applicable |
Work through the guide
Four useful questions
Open a card for a practical prompt.
Decision check
Put the update in your own context
Decision path
Move from news to a controlled change.
- 1ReadPrimary source
- 2CheckYour context
- 3TestLimited scope
- 4ReviewUseful evidence
- 5RecordDecision & owner
Practical response
What to do next
- 01
Place a concise notice before data entry.
- 02
Tell users not to share unnecessary sensitive data.
- 03
Link to the full privacy policy.
- 04
Configure retention and model-training settings.
- 05
Test deletion, access and human escalation requests.
Work through the guide
Review timeline
Move between points to keep a change manageable.
Write down the decision you need to make.
ICO right to be informed guidance
Place a concise notice before data entry.
Tell users not to share unnecessary sensitive data.
Questions
How to use this update responsibly
What period does this article cover?
UK guidance reviewed September 2026. The article was published on 17 September 2026; check the linked source for changes made later.
Does the announcement mean every organisation should adopt it?
No. Availability, cost, risk and usefulness depend on the specific workflow. A limited test with an owner and measurable acceptance criteria is more informative than a provider demonstration.
How should unverified discussion be treated?
Forum posts, rumours and individual reviews can reveal questions worth testing, but they do not establish prevalence or fact. Confirm material decisions through primary documentation, direct testing and qualified advice where necessary.
Relevant service
Need help applying this to your own setup?
Our security, privacy & accessibility service can help you review the current position, decide what is proportionate and plan a clearly scoped next step.
Explore Security, privacy & accessibilitySources
Read the original material
These sources support the factual description above. External pages can change after our publication date.