Tips for an effective data privacy and AI spring clean

Are you confident you know what data flows in, around, and out of your business and that it is properly recorded?

If you do not understand what personal data is being processed, by whom and where, and who it is being shared with, then how can you properly understand and comply with your obligations under UK data protection laws?

Plus, that knowledge gap may in turn lead to a gap in the implementation of appropriate security protections, leaving you vulnerable to data breaches and potentially resulting in the loss of information and its unlawful processing.

Once you have completed your data mapping exercise/audit, ensure you properly document the results in your records of processing activities (ROPA). Even if you carried out a data audit/mapping exercise last year or in the last few years, it is important to repeat such audits/exercises and review your data flow map and ROPA regularly to capture any changes.

Are you confident that you know what cookies are used on your website, provide clear/comprehensive information about your cookie use and are not setting cookies before you have obtained user consent?

If you do not understand what cookies are used on your website, then how can you properly understand and comply with your obligations under UK electronic marketing and data protection laws?

1. Once you have completed your cookie audit, ensure that you:
2. remove any cookies you no longer use;
3. identify what data is collected by each cookie and its purpose;
4. where a cookie collects personal data, process such personal data in accordance with UK data protection laws;
5. identify whether a cookie requires user consent before you can set it, and
6. where the cookie requires user consent, provide an appropriate consent mechanism.

The Data (Use and Access) Act 2025 introduced some new exceptions to the requirement for consent (in addition to strictly necessary cookies) which are explained in guidance issued by the Information Commissioner’s Office (ICO) — the UK’s data protection regulator.

Once you have established what cookies you use, it is important to assess whether any of the exceptions apply and, if they do, consider the specific requirements of the exceptions because the exceptions are narrow in scope and will not apply in all cases.

Cookie compliance continues to be a high priority for the ICO in 2026, which has outlined that its “aim is to ensure organisations comply with the law.” In cases where organisations refuse or fail to comply voluntarily, the ICO says it has “a range of options available for taking formal action where this is necessary”.

It is also important to note that the enforcement regime for the Privacy and Electronic Communication Regulations (PECR) has aligned with the UK GDPR, which means the ICO can use full UK GDPR investigation/enforcement powers for PECR, including increased fines.

Are you confident that you know what AI systems/tools/products are being used within your business?

Whether you design your own AI system, implement a bespoke system from a third party or use AI as a Service (AIaaS) solutions, it is important you know what is being used so you can:

1. identify the risks and appropriate measures to mitigate them;
2. identify whether any AI systems/tools/products are processing personal data;
3. understand what laws, regulations, standards, guidance you need to comply with, and;
4. implement effective policies and procedures.

If you are just starting out on your AI journey and considering using a third-party AI product/solution within your business, it is key to carry out appropriate due diligence on the third party and its product/solution.

Ask the supplier for information about the AI product/solution, including how it works, what data it was trained on, any guarantees about the source of information, etc.

Do not take the product/solution at face value. Make sure you test it before you implement it within your business, ask your internal experts to help with the testing to make it does what it is advertised to do and, more importantly, what you need it to do for your business.