I recently attended the ICO DPCC 2026, where data protection professionals explored the challenges and opportunities shaping the sector. Here, I share practical lessons from the day on responsible AI, cyber resilience and information rights.
By Clare Chatfield, Information Governance Manager
What organisations should take away on responsible AI, cyber resilience and information rights
Artificial intelligence is changing how organisations use personal data and how individuals exercise their information rights. A consistent message from the conference was that effective data protection depends as much on people, culture and sound operational practice as on technology.
Innovation is possible, but it must be supported by transparency, proportionate governance and meaningful human oversight.
Responsible AI starts with understanding the risks
AI systems can generate information about people, draw inferences, and influence decisions. Data leakage can enable unintended profiling or function creep, while biased data or inferences can produce discriminatory outcomes. These connected risks must therefore be assessed together rather than in isolation.
AI governance should be practical and risk based. Before using a system, organisations should establish what data they receive and what outputs they produce. They should then identify who may be affected, how people can challenge decisions, and which wider duties apply, including equality, human rights and online safety.
AI literacy is central. Staff need the confidence to question AI outputs rather than treat them as authoritative. Organisations must also explain complex uses clearly enough to support genuine transparency and informed choice.
Keep people at the centre
Cyber incidents affect people as well as systems. Employees may face substantial emotional and psychological pressure, yet response plans often focus only on technical recovery and regulatory reporting. When staff fear blame or embarrassment, they may delay escalating an incident, giving criminals more time to cause harm.
Preparedness should include clear reporting routes, a no-blame culture and support for affected staff. Cyber resilience is a shared organisational responsibility, not a burden for one individual.
Young people’s experiences reinforced the need to build privacy and safety into digital services. Children should not have to become data protection experts to participate online. Organisations should involve young users and test whether safeguards work in practice.
AI is an assistant, not an authority
Information rights teams are already seeing AI’s impact. It can enable longer, more complex freedom of information and subject access requests, but at the same time can assist practitioners in drafting, summarising and checking responses.
Used carefully, these tools can improve efficiency and accessibility. However, generated content may contain inaccurate references, and complex AI-assisted requests may obscure what the requester actually wants. Practitioners should therefore focus on the substance, seek clarification only where necessary and communicate early.
Searches for personal data must be reasonable and proportionate, rather than necessarily exhaustive. To support effective searches, organisations should know what information they hold, where it is stored, who controls it, and how long it is retained. They should also document search decisions and exemptions consistently.
Five practical priorities
Organisations can put these lessons into practice by:
- mapping AI use and assessing leakage, inference and discrimination risks;
- building human review and challenge into AI-assisted processes;
- strengthening records management, retention and search procedures;
- including staff wellbeing and supportive reporting in incident plans; and
- designing transparent, accessible services for children and other potentially vulnerable groups.
Summary
The central lesson is that responsible AI requires technical controls, clear governance, confident people, proportionate information-rights processes and a culture that protects both staff and the individuals behind the data.
Rather than creating a barrier to progress, well-designed data protection provides the structure, accountability and trust that responsible innovation requires.
Are you looking to understand how to deal with increasingly frequent Freedom of Information requests, like some colleagues at the conference? Our CPD-accredited, half-day intermediate course Freedom of Information Act and Environmental Information Regulations provides a practical introduction to the Freedom of Information Act (FOIA) and the Environmental Information Regulations (EIR). While the main focus is FOIA, the course also includes an overview of EIR, helping you understand your responsibilities when individuals exercise their rights to access information. Through real-world scenarios, you’ll be guided step by step through handling requests, applying exemptions, managing refusals, and understanding appeals processes – giving you the tools to manage requests compliantly and confidently. Next running 19 November (9:30am-1pm), click the link above to book your place or email info@naomikorn.com for more information.