Can customer data be used with AI under UK GDPR?

Yes, where the processing complies with the applicable data-protection requirements. The fact that a system uses AI neither permits nor prohibits the use by itself.

The ICO distinguishes developing an AI system from using it for predictions. Each distinct processing operation needs a purpose and an appropriate lawful basis. Different circumstances can support different bases. ICO guidance on lawfulness in AI

Consent is one possible basis, not a universal permission. The information used, the effect on people and the proposed activity determine which further requirements apply.

What does AI profiling change for direct marketing?

AI profiling analyses information about people to inform marketing decisions. The activity is subject to transparency requirements and the right to object to direct marketing.

ICO guidance requires businesses to explain the collection and use of personal information for direct marketing, including relevant profiling. People also have a right to object to direct marketing. Publicly available information does not remove those responsibilities. ICO direct-marketing guidance

Electronic messages have additional rules under PECR. Marketing emails to individual subscribers generally require consent unless an applicable exception, such as the qualified existing-customer exception, is met. ICO electronic-mail guidance

When does an AI marketing use need a privacy impact assessment?

A data protection impact assessment is required where the processing is likely to create a high risk to people’s rights and freedoms.

The ICO’s AI accountability guidance explains how the purpose, data, affected population and controls contribute to that assessment. Where a DPIA is required, it precedes the processing. The guidance also places accountability with the organisation rather than treating it as a purely technical task. ICO guidance on AI accountability

A vendor’s security statement or training exclusion answers a narrower question. It does not establish the lawfulness of the customer’s intended use.

Do automated decisions and sensitive data have additional requirements?

Yes. Special category data and significant decisions made entirely by automated means raise additional legal questions.

The Data (Use and Access) Act 2025 changed the UK framework, including automated decision-making provisions. The ICO explains that safeguards remain relevant and that special category data has tighter conditions. UK and EU rules are not interchangeable. ICO’s explanation of the Act

Application depends on the decision and its effect on the person. The published guidance was checked on 6 October 2026. Parts of the ICO’s AI guidance remain under review following the Act.

Legal note: This answer provides general information, not legal advice. Seek advice from qualified legal counsel for your circumstances.