UK ICO – consultation series on generative AI

AI

Guidelines 02/2024 on Article 48 GDPR by EDPB

Data Transfers

Decision of 19 October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra

Adequacy Decisions

Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina

Adequacy Decisions

Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act

Adequacy Decisions

Decision of 5 March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data

Adequacy Decisions

Decision of 21 November 2003 on the adequate protection of personal data in Guernsey

Adequacy Decisions

Decision of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data

Adequacy Decisions

Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man

Adequacy Decisions

Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information

Adequacy Decisions

Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey

Adequacy Decisions

Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand

Adequacy Decisions

Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act

Adequacy Decisions

Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland

Adequacy Decisions

Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800)

Adequacy Decisions

Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom

Adequacy Decisions

Decision EU 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive Version 2.0 by EDPB

New technology

New data protection audit framework launched to help organisations improve compliance by UK ICO

Controllers and Processors, Data Sharing, Data Subjects Rights

EDPS Model Administrative Arrangement

Data Processing by the Government, Data Transfers, Specific processing situations

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

Biometric Data Guidance by the UK ICO

Principles, Sensitive Data

SWISS-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

NIST Cybersecurity Framework 2.0: RESOURCE & OVERVIEW GUIDE

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

[UK EXTENSION] EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

Guide to Technical and Organisational Data Protection Measures (TOM) by the Swiss FDPIC

Controllers and Processors, Technical and Organisational Measures (TOMs)

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

NIST Privacy Framework v1

NIST Critical Infrastructure Framework

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Guide to Binding Corporate Rules by the UK ICO

Data Transfers

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

How to handle someone’s data subject access request when there is information about other individuals involved by the Irish DPA

Access Requests (DSAR), Data Subjects Rights

International data transfer agreement and guidance by the UK ICO

Data Transfers

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

Guidelines on submission of signals under the Whistleblowing directive by the Bulgarian CPDP

Whistleblowing

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

[DRAFT] Data Confidentiality – Identifying and Protecting Assets Against Data Breaches by NIST

Controllers and Processors, Data Breaches

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

Guidelines issued by the Malta Gaming Authority for the Maltese Gaming Industry

Gaming, Specific processing situations

Practical Guide on Controller to Processor Contracts by the Irish DPC

Controllers and Processors, Data Processing Agreement (DPA)

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

AUTOMATED DECISIONMAKING TECHNOLOGY REGULATIONS (DRAFT) by CPPA

Automated Decision-making, Controllers and Processors

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

Guidance on the Use of CCTV – For Data Controllers by the Irish DPC

CCTV, Specific processing situations

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive by EDPB

Consent, Lawfulness of Processing

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Child oriented approach to data processing by DPC Ireland

Children as data subjects, Data Subjects Rights

Bulgarian CPPD Newsletter

Children as data subjects, Controllers and Processors, Data Subjects Rights, Technical and Organisational Measures (TOMs)

DSAR management for controllers by Bailiwick of Guernsey’s DPA

Access Requests (DSAR), Data Subjects Rights

Drones and Data Protection Guidelines by AEPD

Drones, Specific processing situations

AI How-to Sheets by CNIL

AI, Specific processing situations

Mobile Privacy Disclosures by the FTC

Data Subjects Rights, Right to know

Data breach preparation and response by the Australian Information Commisioners

Controllers and Processors, Data Breaches

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

Public Benefit and Privacy Panel for Health and Social Care (Guidance for applicants)

Health Data, Principles, Sensitive Data

How to use AI and personal data

AI, Specific processing situations

Data protection and monitoring workers

Employment, Specific processing situations

Baseline Cyber Security for SMEs

Controllers and Processors, Technical and Organisational Measures (TOMs)

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Data Transfers

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

EU-U.S. DATA PRIVACY FRAMEWORK F.A.Q. FOR EUROPEAN BUSINESSES BY EDPB

Data Transfers

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

Guidance document on how to approach the protection of personal data and commercially confidential information while using the Clinical Trials Information System (CTIS) Version 2 by EMA

Data Subjects Rights

Guidelines 01/2023 on Article 37 Law Enforcement Directive by EDPB

Data Transfers

Guidelines scraping by private organizations and individuals by the Dutch Data Protection Authority

Automated Decision-making, Controllers and Processors

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

A Guide to ICO Audit Artificial Intelligence (AI) Audits by UK ICO

AI, Specific processing situations

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

Data Sharing Code of Practice by UK ICO [Controller to Controller]

Controllers and Processors, Data Sharing

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Deploying AI Systems Securely by NSA

AI, Specific processing situations

Data Protection Fining Guidelines by UK ICO

Liability and Remedies, Supervisory Authorities

Handling vexatious requests under FOIA by the UK ICO

How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

Guidance Note: Employer Vehicle Tracking | Irish DPC

Employment

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

What is Personal Data | UK ICO

Personal Data

Data Subjects Rights | UK ICO

Data Subjects Rights

Data Protection and Journalism | UK ICO

Freedom of expression and information

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679

Automated Decision-making

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

Guidance on ai and data protection 2.0 | UK ICO

AI

Children and the GDPR | UK ICO

Children as data subjects

Data Sharing Code | UK ICO

Data Processing Agreement (DPA)

Guide to Accountability and Governance | UK ICO

Accountability

Guidance on Video Surveillance | UK ICO

CCTV

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Data Transfers

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Elaboration of the Code of Conduct for Cloud Infrastructure Service Providers (CNIL)

Cloud Services

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Guidelines on Data Protection Officers (‘DPOs’)

Data Protection Officer (DPO)

Guidelines on transparency under Regulation 2016/679

Transparency

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

AI

Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

Data Breaches

Guidelines 10/2020 on restrictions under Article 23 GDPR

Data Subject Rights Restrictions, Data Subjects Rights

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 02/2021 on virtual voice assistants

Voice Assistants

Guidelines 8/2020 on the targeting of social media users

Data Subjects Rights

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications

Connected Vihicles

Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Data Transfers

Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

Privacy by Design

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR

Right to Erasure

Guidelines 05/2020 on consent under Regulation 2016/679

Consent, Lawfulness of Processing

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

Health Data

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Health Data

Guidelines 3/2019 on processing of personal data through video devices

CCTV

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Territorial Scope

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Performance of Contract

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Code of Conduct

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

Certification

Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

Certification

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Guidance on the rules on use of cookies and similar technologies [pdf] [Official Guidelines]

Consent, Cookies

Guidelines 9/2022 on personal data breach notification under GDPR [Official EDPB Guidelines] [pdf]

Data Breaches

Guidelines 04/2022 on the calculation of administrative fines under the GDPR

Liability and Remedies

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Supervisory Authorities

Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority

Supervisory Authorities

Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement

Guidelines 01/2022 on data subject rights – Right of access

Data Subjects Rights

Guidelines 07/2022 on certification as a tool for transfers

Certification

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

Territorial Scope

Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

Privacy by Design

Guidelines 06/2022 on the practical implementation of amicable settlements

Guidelines 04/2021 on Codes of Conduct as tools for transfers

Data Transfers

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Technical Recommendations on the use of APIs by CNIL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

The Employment Practices Code | UK ICO

Data Subjects Rights, Employment

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management

The EDPB data protection guide for small business

AI, Risk Management