iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Responsibility depends on the specific processing activity, not simply on who built or sells the AI. Under the UK GDPR framework explained by the Information Commissioner’s Office (ICO), the organisation that decides why personal data is processed and the essential means of doing so is generally the controller. An organisation that processes data only on a customer’s documented instructions is generally a processor. An AI provider can be a processor for one activity, a controller for another, and a joint controller with a customer for a third.
To answer who is responsible, map each data flow—such as collection, model training, fine-tuning, evaluation, prompt handling, retention and analytics—then identify who determines its purpose and means. The applicable country’s law, the parties’ actual decisions and conduct, and the contract all matter. Contract labels alone do not settle the question.
Why there is no single “AI company” answer
An AI system usually involves several organisations and several uses of data. A customer may collect information from its users, send selected records to a hosted model, ask the provider to fine-tune a model, and receive outputs through an application. The provider may separately monitor service performance, prevent abuse, improve its own models or retain logs. Those are distinct processing activities with potentially different purposes and decision-makers.
The ICO puts the point this way: “As AI usually involves processing personal data in several different phases or for several different purposes, it is possible that you may be a controller or joint controller for some phases or purposes, and a processor for others.” The practical consequence is that responsibility must be allocated activity by activity rather than assigned to the developer, deployer or vendor as a whole.
Controller, processor or joint controller?
Controller: decides the “why” and essential “how”
A controller determines the purposes of processing and the essential means. Relevant decisions can include what data to collect, why to use it, whose data is involved, how long it is retained and how requests from individuals will be handled. A company deploying an AI assistant to analyse its customers’ support tickets will usually be a controller for that customer-data use because it decides the business purpose and the scope of the analysis.
Controller status brings accountability. Article 24(1) of the EU General Data Protection Regulation (GDPR) says: “the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.” That includes being able to explain the legal basis, purposes, safeguards, retention and rights processes for the relevant activity.
Processor: acts on documented instructions
A processor handles personal data on behalf of a controller and does not decide an independent purpose for that processing. A model-hosting provider may be a processor when it stores prompts, runs inference or performs customer-requested fine-tuning solely under the customer’s documented instructions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Processor does not mean “no responsibility.” Under the GDPR, processing must be governed by a contract or other legal act, and the processor must follow documented instructions. UK ICO guidance also describes direct processor duties and potential liability when a processor fails those duties or acts outside lawful instructions. A processor must therefore apply required security, confidentiality, sub-processor controls, assistance with rights and breach obligations, and deletion or return requirements where the contract and law require them.
Rank #2
Joint controllers: shared decisions
Two organisations can be joint controllers when they jointly determine the purposes and means of a processing activity. They must transparently set out their respective responsibilities, including how people receive information and exercise their rights. The arrangement does not prevent an individual from exercising GDPR rights against each controller. Calling a relationship “joint control” in a contract is not enough; the parties’ actual influence over purposes and means is the starting point.
Is an AI company a controller or a processor?
It can be either, or both at different stages. Consider a provider that operates a hosted model for a retailer:
| Activity | Likely role of retailer | Likely role of provider | What decides the result |
|---|---|---|---|
| Retailer sends order-support prompts for live answers | Controller for the customer-service purpose | Processor if it follows the retailer’s instructions and uses the data only to deliver the service | Purpose, permitted data, retention and other essential means |
| Provider retains prompts to improve its general model | May remain a controller for the retailer’s original use | May be a separate controller for its own improvement purpose | Whether the provider independently chooses and pursues that reuse |
| Customer-requested fine-tuning for the retailer’s internal model | Controller for its business purpose | Processor if the work is limited to documented instructions | Who determines the training purpose, data scope and model-use conditions |
| Provider and retailer jointly design a new profiling service | Possible joint controller | Possible joint controller | Evidence of shared decisions about purpose and essential means |
The table describes a way to analyse roles, not an automatic legal outcome. The same provider could be a processor for inference, a controller for security monitoring or billing analytics, and a joint controller for a jointly designed product.
What does “reuse” of personal data include?
“Reuse” is not one legal operation. Define the exact activity before assigning responsibility:
- Training or pre-training: using personal data to develop a general or domain model.
- Fine-tuning: adapting an existing model with a customer’s records or examples.
- Evaluation and testing: measuring model performance with identifiable prompts, documents or labels.
- Prompt and output handling: transmitting, storing, reviewing or using live interactions.
- Retention and logging: keeping prompts, outputs, account identifiers or telemetry after a response.
- Analytics and safety: using records for fraud detection, abuse prevention, debugging or service metrics.
Each purpose can have a different legal basis, retention period, notice requirement and controller or processor allocation. A statement that a provider “does not train on data” may still leave separate questions about abuse monitoring, human review, troubleshooting or temporary retention.
Who is liable if an AI tool trains on customer data?
Liability follows the legal duties attached to the particular activity. If a customer decides to send personal data for a training project, it normally remains accountable for its own controller decisions: identifying a lawful basis, limiting the data, assessing risks, providing information and handling rights. If the provider independently decides to use those records to improve its own model, that independent purpose can make the provider a controller for the reuse, with its own transparency and compliance duties.
If the provider was supposed to follow instructions but used the data outside them, it may face direct processor liability and contractual consequences. The customer may also face exposure if its instructions were unlawful, inadequate or inconsistent with what it told people. Responsibility can therefore be concurrent rather than transferred entirely to one party.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe answer cannot be determined from a marketing term such as “no training,” “private instance” or “enterprise plan.” Examine the actual settings, default retention, human-access procedures, sub-processors, product-improvement terms and technical controls in force for the relevant edition and region.
How to map responsibility for an AI data flow
Use the following sequence for every distinct processing operation. It structures an assessment; it does not replace advice on the law of a particular country.
- Describe the data. List the fields, documents, prompts, outputs, identifiers and metadata involved. Decide whether they are personal data under the applicable framework, including whether people can be identified indirectly.
- State one precise purpose. Write what the organisation is trying to achieve at this stage: answer support questions, train a model, detect abuse or measure quality. Avoid combining unrelated purposes in one description.
- Identify the decision-maker. Ask who chose the purpose and the essential means, such as data selection, retention, access, model configuration and handling of rights requests.
- Test independence. Is the provider acting solely on documented client instructions, or does it decide to retain, analyse or reuse data for its own purpose? Independent purpose-setting points toward controller status for that operation.
- Compare documents with conduct. Review the data-processing agreement, product terms, instructions, technical configuration and actual practices. A processor label does not cure conduct that shows independent decision-making.
- Assign rights and communications. Record which organisation gives privacy information, receives access or deletion requests, coordinates corrections and communicates a breach. Make the route usable in practice, not merely contractual.
- Check jurisdiction and change control. Apply the relevant EU GDPR, UK GDPR or other national rules, including current amendments and regulator guidance. Reassess when the model, data source, retention setting or purpose changes.
Training reuse and transparency
The ICO says people should be informed if their data will be used to train an AI system. When data collected for another purpose is later used for AI training, the organisation must address whether the new purpose is compatible with the original one and tell individuals, subject to applicable exemptions and circumstances.
A clear notice should identify the training purpose, categories of data, retention, recipients or provider roles, relevant rights and how to exercise them. “We use data to improve services” may be too vague if the meaningful new use is model training. Explain whether training is performed by the organisation, a provider on instructions or a provider pursuing its own purpose.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Contracts should allocate work, not conceal it
A controller–processor contract should describe the subject matter, duration, nature and purpose of processing; the types of personal data; the categories of people involved; documented instructions; confidentiality; security; sub-processors; assistance with rights and impact assessments; breach support; audit information; and deletion or return at the end of service, as required by the applicable law.
Best Value
- Updated Compliance: While the new rule takes effect on 7/19/2024, training and compliance dates don’t start until 1/19/2026, giving your team ample time to prepare with this thorough guide to OSHA regulations (29 CFR 1910.1200(j)).
- Comprehensive Safety Training Handbook: Prepares your employees for 25 of OSHA’s hottest safety topics, from Confined Space Entry to Workplace Violence, ensuring they are equipped with vital safety knowledge for a safer work environment.
- In-Depth, Easy-to-Understand Content: Each chapter tackles key workplace hazards like Electrical Safety, Lockout/Tagout, Respiratory Protection, and more, helping to prevent injuries and illnesses while promoting safe practices.
- Interactive Learning with Quizzes: Engaging chapter review quizzes reinforce safety concepts, making it easier for employees to retain and apply the knowledge, with downloadable answer keys for easy tracking.
- Specifications: English, Softbound, full-color pages (272 pages) offer clear, visually appealing safety information for a diverse workforce, with home safety details included throughout.
For AI, add operational specifics: whether prompts and outputs are retained, whether they enter training or evaluation sets, who can review them, where they are transferred, how opt-out or exclusion controls work, and how a customer can verify that settings are applied. If a provider wants to use data for a separate purpose, document that purpose and analyse the provider’s resulting controller obligations rather than leaving the issue in generic improvement language.
Common mistakes and how to correct them
- “The vendor is always responsible.” Correct it by mapping purposes and phases; the customer may be the controller for deployment, while the vendor has processor or separate-controller duties.
- “The customer owns the data, so the customer controls everything.” Ownership is not the GDPR test. Look at who determines purposes and essential means.
- “A processor has no liability.” Processors have direct statutory and contractual duties and can be liable for their own failures or unlawful departures from instructions.
- “One contract label covers the whole platform.” Split inference, storage, training, safety analytics and support into separate activities.
- “Training is the only reuse that matters.” Review logs, evaluation, human review, abuse detection, debugging and retention as well.
- “A privacy notice written at collection covers every later use.” Test compatibility and provide information about the later AI purpose where required.
- “Roles never change.” Revisit them when a provider introduces a new improvement programme, changes defaults, adds a sub-processor or receives new categories of data.
EU GDPR and UK GDPR: a careful qualification
The EU GDPR expressly sets controller accountability, joint-controller transparency and processor contract and instruction duties in Articles 24, 26 and 28. UK ICO guidance uses the same controller–processor structure for AI role analysis and explains how responsibilities can vary by phase.
The ICO notes that its UK GDPR guidance is under review following the Data (Use and Access) Act. UK organisations should therefore verify the current legislation and regulator position before relying on a specific interpretation. Neither the EU text nor the UK guidance supplies a universal answer without the facts of the deployment, and other jurisdictions may use different concepts or additional rules.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A practical record to keep
For each AI data flow, maintain a short role-and-purpose record containing:
- the activity name and precise purpose;
- data categories and people affected;
- the controller, processor or joint-controller conclusion and its factual reasons;
- the lawful basis, retention and access controls;
- instructions, contract clauses and technical settings;
- notice, rights-request and incident responsibilities;
- sub-processors, transfers and security measures;
- the trigger and date for the next review.
This record lets an organisation demonstrate accountability and quickly detect when a product change has created a new purpose or role.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
