Blog

AI compliance is the framework of policies, processes, and controls organisations put in place to ensure artificial intelligence systems are used responsibly, lawfully, and in line with organisational values. For in-house legal teams, this has become increasingly urgent as regulators place greater scrutiny on how automated systems impact individuals’ rights.

AI governance is the set of policies and processes that make sure AI systems are deployed in a responsible, lawful, and transparent way. It covers the full lifecycle, from data sourcing to incident response, and brings together policy, legal oversight, risk management, and continuous monitoring so decisions made are both auditable and accountable.

Data breaches and failures to apply appropriate technical and organisational measures are, in the vast majority of cases, the responsibility of the organisation that holds the personal data, and it is the organisation that is usually the primary target for ICO investigations and fines under the GDPR and the Data Protection Act 2018 (DPA).

A Subject Access Request (SAR) – also known as a “Data Subject Access Request” – is a formal request made by an individual to an organisation, requesting access to the personal data that organisation holds about them. Under data protection law, including the UK GDPR and Data Protection Act 2018, every individual has the right to know how their information is being used, stored, and shared.

In the majority of cases, responses to Data Subject Access Requests (DSARs) must be completed within one month after a request has been received with all of the required identification information. However, DSAR responses can be extended by two months for complex or multiple requests. 

A Data Protection Officer (DPO) is a mandated role under both the EU and UK GDPR for certain organisations - notably public bodies and those that process large volumes of sensitive personal data. As an independent advisor, the DPO interprets legal obligations, identifies and mitigates data-protection risks, and ensures the organisation can demonstrate clear accountability for how personal data is handled. 

Organisations that are required - or elect - to appoint a Data Protection Officer (DPO) face an important choice: recruit an internal DPO as a permanent member of staff, or consult an external provider to deliver the role on an outsourced basis. Internal appointments involve salaries and training commitments, while outsourced DPO services are typically offered under fixed-fee or retainer arrangements that combine expertise, scalability, and continuity.

At a Glance…

• A DPO is mandatory under the GDPR for organisations engaged in large-scale monitoring, those processing special category or criminal data, or public authorities
• Voluntary appointments are encouraged for organisations wanting to demonstrate accountability and strengthen their data protection practices
• Outsourcing a DPO is a practical solution for many businesses, offering flexibility and compliance support without the burden of internal resourcing

The UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 set stringent rules for handling personal data, and non-compliance can lead to both large fines and reputational damage. To meet these requirements, many organisations (especially large-scale processors of sensitive data, those conducting systematic monitoring, and public bodies) must appoint a qualified Data Protection Officer (DPO).

In a previous blog post, we briefly outlined the plans of the European Union (EU) to facilitate access to high-quality data for scientific research. Three main EU initiatives aim at enabling such access. The first initiative focusses on the establishment of a network of common European data spaces that will intermediate pooling and shared use of data among EU-based organisations in various sectors (e.g. health, energy, agriculture, finance).

Scientific research is front and centre in innovation policies across Europe, and the European Union (EU)'s research agenda makes no exception. In April and May alone, the EU announced its plans to boost research efforts and collaborations, to facilitate access to high-quality data for innovation and to support the development of home-grown artificial intelligence (AI) models and applications.

In a previous blog post, we outlined the typical privacy and data protection implications of conducting biomedical research using personal data from health databanks. These implications relate to the reliability of anonymisation, valid grounds for the reuse of health data, transparency and disclosure, data minimisation, adequate privacy safeguards for harm prevention, and the use of predictive analytics and artificial intelligence.