SMEs & Public Sector
Participants produce Data Protection Impact Assessment (DPIA) documentation during this course, not after it. A full-day session covering UK GDPR as it applies to AI, built around your organisation's own tools, data and approved platforms. Your team leaves with compliance evidence that meets ICO audit expectations.
Standard data protection training does not cover what happens when personal data enters an AI system. UK GDPR applies to AI processing the same way it applies to any other processing of personal data. The ICO expects documented evidence that staff understand the data protection implications of the AI tools they use. Most organisations using AI cannot produce that evidence.
49% of non-adopters cite data privacy and security as their primary concern (YouGov B2B Omnibus, August 2025). Practitioner research cross-referenced in early 2026 found that around 59% of employees are using AI tools their organisations have not approved. Personal data is being entered into AI tools the organisation has not assessed, without a DPIA, without documented lawful basis and without training records.
The gap between what your organisation does with AI and what UK GDPR requires you to document is where regulatory risk builds.
This course is designed for information governance leads, Data Protection Officers (DPOs), operations managers, HR managers, and anyone responsible for AI tools that handle personal data.
In practice, that includes the person who approves which AI tools staff are allowed to use, the manager who signs off on a new AI workflow touching customer or employee records, and the operations lead who introduced an AI tool to handle client correspondence without checking the data protection implications. If your role means you would respond to an ICO enquiry about how personal data is processed by AI, this course covers what you need to know.
| Right for you if | Not right for you if |
|---|---|
| Your organisation uses AI tools that process personal data | You need a general introduction to what AI is and how it works (start with AI Fluency for Organisations) |
| You need DPIA documentation for AI deployments | You need to build an organisation-wide AI governance policy (progress to AI Governance for Organisations) |
| You need to show the ICO that staff are trained on AI and data protection | Your staff only need to know which tools are approved and how to use them safely (consider Safe Use of Generative AI Tools) |
| You want to understand what the Data (Use and Access) Act 2025 means for automated decisions in your organisation | You are looking for AI strategy or implementation support rather than compliance training |
Participants leave with operational skills they will use repeatedly, not a one-off compliance exercise. After the course, your team can:
UK GDPR as it applies to AI systems: data classification for AI use, DPIA methodology, lawful basis for processing, ICO training documentation requirements, and the DUAA 2025 meaningful human intervention standard. Every session is built around your organisation's own tools and data environment, not a generic workbook.
Topics include what data can and cannot be entered into AI systems, how to conduct a DPIA for an AI deployment, the legal consequences of failing to train staff before they access personal data (risking breach of Articles 5(1)(f) and 32 UK GDPR), and what the DUAA 2025 means when AI contributes to a decision about an individual. Rubber-stamping an AI output does not satisfy the meaningful human intervention standard. The course teaches your team what does.
Participants receive a method guide they use after the course to apply these requirements whenever a new AI tool is introduced or an existing workflow changes.
Before the session, we conduct a scoping call to understand your organisation's AI tools, data handling practices and compliance position. We map your training needs against the ICO's audit expectations and your regulatory obligations.
The course is delivered in-house at your premises or online via video call, for groups of up to 15 participants. Larger teams are accommodated across multiple sessions. All materials are written for your organisation, your approved tools and your sector's regulatory obligations.
Participants receive documented evidence of training completion meeting ICO audit expectations. The course produces DPIA documentation during the session (where applicable) that can be presented directly to regulators.
Using AI to process personal data triggers a legal requirement for a Data Protection Impact Assessment under Article 35 UK GDPR. DPIAs must document that staff involved in deploying and monitoring AI systems are adequately trained and understand the data protection implications. This course teaches participants how to conduct and document a DPIA for AI deployments.
The ICO expects organisations to maintain documented training programmes, completion records and assessment evidence under the UK GDPR accountability principle. The ICO's Data protection audit framework (launched October 2024) includes five control measures for training that set the standard Insightful AI courses are designed to satisfy.
The Data (Use and Access) Act 2025 requires meaningful human intervention in automated decisions. A person must genuinely review and be able to challenge any AI-driven decision, not simply approve it. Rubber-stamping AI outputs does not satisfy that standard. This course addresses that gap directly.
Maps to the six AI foundation skills set out in Skills England's "AI foundation skills for work" (January 2026). This is a voluntary benchmark, not a legal requirement.
For organisations with EU exposure, Article 4 of the EU AI Act (Regulation (EU) 2024/1689) creates a direct obligation to ensure staff AI literacy, in force since February 2025.
This course is delivered by the Insightful AI training team, led by co-founders Ben Sefton and Kane Lukassen. Insightful AI is registered on the UK Register of Learning Providers (UKPRN: 10098807).
Our training differs from generic provision in one respect that is worth stating plainly: we name the specific obligations each course addresses. Article 35 UK GDPR. The ICO's five audit control measures for training. The DUAA 2025 meaningful human intervention standard.
This is course two of six in the Insightful AI training programme for SMEs and public sector organisations. It sits between AI Fluency (the foundation) and AI Governance (the broader policy and compliance architecture).
Organisations that need a full governance engagement rather than training alone should see our AI Ethics & Governance service. For details on how Insightful AI handles data during engagements, see Security & data protection.
The discovery call covers your organisation's AI tools, data handling and compliance position. We use it to scope the session and build your bespoke materials. No obligation.
Book a free discovery callWhether you're just getting started or looking to scale, we'll help you find the right path, responsibly.