Generative artificial intelligence is a data-intensive method of developing applications and services. The market that revolves around it has had exponential growth and created high expectations. As recital 7 of the GDPR explains that “Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust”. The British Data Protection Authority (ICO) has carried out a consultation on targeted areas of generative AI development and deployment and, based on it, has issued clarifications for developers to comply with data protection regulations. The evidence submitted surfaced a series of misunderstandings existing positions the regulator had. These findings are presented in this article.