UK ICO Says AI Drafted Data Access Requests Remain Valid

The UK’s Information Commissioner’s Office (ICO) published guidance on its website saying organisations must treat subject access requests drafted with AI like any other request. A request remains valid when it is clear that a person wants access to their personal information, even if it contains inaccurate legal claims, references to nonexistent cases or false contact details.

Organisations must respond as soon as possible and no later than one month after receiving the request and any required identity documents, proof of authority or fee. They may seek clarification when reasonably necessary, which pauses the response deadline, but cannot require the person to narrow or rewrite the request.

Using AI does not automatically make a request complex. Organisations may extend the deadline by up to two months only when genuine difficulties arise in locating, reviewing or disclosing information. They must conduct a reasonable and proportionate search, consider specific requests for information such as metadata, and verify identity or authority documents if fraud is suspected.