Oversight and Risk

ICO

AI and Data | AI in Telecoms | AI Regulation | Data protection | DSIT | English law local counsel | EU | Government policy | Ofcom | Oversight and Risk | Regulatory action | Telecoms | Telecoms regulation | Transactions co-counsel | UK

EU Digital Omnibus: simplification or new complexity for digital and AI regulation?
ByRob Bratby 21 November 202521 November 2025

EU Digital Omnibus: simplification or new complexity for digital and AI regulation? What has happened and why does it matter? The European Commission has proposed a Digital Omnibus Regulation to streamline elements of the EU’s digital legislative framework, including amendments to the GDPR, ePrivacy Directive, NIS2 and the Data Act, while repealing several existing measures…

Read More EU Digital Omnibus: simplification or new complexity for digital and AI regulation?
Regulatory action | AI Regulation | DSIT | Oversight and Risk | UK

When Regulators Regulate Themselves: The UK judiciary and data protection regulator (ICO) guidelines for internal AI use
ByRob Bratby 6 November 202521 November 2025

UK Judges and ICO publish internal AI use guidelines In the UK’s rapidly developing AI governance landscape, two institutions have taken a decisive and self-reflective step. The Judiciary of England and Wales and the Information Commissioner’s Office (ICO) have both published their internal policies on the use of artificial intelligence. These are not external consultation papers or policy statements…

Read More When Regulators Regulate Themselves: The UK judiciary and data protection regulator (ICO) guidelines for internal AI use
Regulatory action | AI Regulation | Brexit | Data protection | EU | Government policy | Oversight and Risk | UK

The Data (Use and Access) Act 2025: What It Means for UK Businesses
ByRob Bratby 28 October 202521 November 2025

The Data (Use and Access) Act 2025 (DUAA) introduces sweeping changes in UK data regimes, from smart-data schemes and digital verification services to amendments of the Data Protection Act 2018 and UK GDPR. Rob Bratby of Bratby Law guides UK businesses through compliance, strategic opportunities, and contract implications. Essential reading for counsel, transaction teams and commercial leaders.

Read More The Data (Use and Access) Act 2025: What It Means for UK Businesses
UK | AI Regulation | Data protection | Oversight and Risk

UK AI Regulation: ICO’s Role
ByRob Bratby 26 October 202521 November 2025

UK AI Regulation: ICO’s Role How should businesses navigate AI compliance in the UK? In contrast to the EU’s broad, sector-agnostic AI Act, the UK has taken a different approach to AI regulation. The UK government has opted for a regulator-led, principles-based framework, asking existing sector regulators to oversee AI in their own domains, which…

Read More UK AI Regulation: ICO’s Role
AI and Data | AI in Telecoms | AI Regulation | Data protection | EU | Fractional General Counsel | Ofcom | Oversight and Risk | Specialist Co-counsel | UK

UK AI Regulation: An overview
ByRob Bratby 26 October 202524 November 2025

UK AI Regulation: An overview Introduction In contrast to the overarching, prescriptive approach of the EU AI Act, the UK’s approach to regulating artificial intelligence (AI) is to focus on regulating the use of AI, rather than the underlying AI technology. The UK’s objective is to foster innovation whilst managing risks. 2023 UK AI Regulation…

Read More UK AI Regulation: An overview
Brexit | Cloud computing | Data protection | Digital | DSIT | Government policy | Oversight and Risk | Regulatory action | UK

New UK data protection law proposals
ByRob Bratby 30 June 202217 November 2025

Government sets out response to consultation Commentary Following its September 2021 consultation on reform of UK data protection law, on 23 June 2022 the UK government published its response and proposals to move forward. Whilst the proposals for a post-GDPR data protection law in the UK contain some sensible reforms and updates, it is clear…

Read More New UK data protection law proposals
Brexit | Cloud computing | Data protection | DSIT | Government policy | Oversight and Risk | Regulatory action | Technology | UK

Personal data export from the UK
ByRob Bratby 4 March 202217 November 2025

UK sets out two alternatives to provide adequate contractual protection for the export of personal data from the UK What happened? In February 2022, the UK government published 2 alternative sets of contracts that can be used by organisations wishing to export personal data from the UK to countries that do not otherwise provide adequate…

Read More Personal data export from the UK
Brexit | Cloud computing | Data protection | Digital | Government policy | Oversight and Risk | Regulatory action | Technology | UK

UK’s proposed new data protection law
ByRob Bratby 30 September 202117 November 2025

New UK data protection law: worthwhile divergence or political point-scoring? What is proposed? On 10 September 2021, the UK government published its proposals to reform UK data protection law. Whilst current UK data protection law in the form of UK GDPR mirrors EU data protection law, the proposals represent the UK government seizing the opportunity…

Read More UK’s proposed new data protection law
Brexit | Cloud computing | Data protection | EU | Government policy | Oversight and Risk | Regulatory action | Software | Technology | UK

EU finds UK has adequate protections for personal data
ByRob Bratby 29 June 202127 June 2022

On 28 June 2021, the EU Commission found that the UK provides adequate protection for personal data, enabling personal to freely flow from the EU (and EEA) to the UK. Background European privacy law (specifically articles 44-50 of the General Data Protection Regulation (GDPR)) prohibits the export of personal data from the EU to a third…

Read More EU finds UK has adequate protections for personal data
Cloud computing | Data protection | EU | Oversight and Risk | UK

Using the new EU standard clauses to enable cross-border data export
ByRob Bratby 16 June 202127 June 2022

From 27 June 2021, organisations will be able to adopt new ‘standard contractual clauses’ (SCCs) to permit lawful export of personal data from the EU to ‘third countries’. This post: recommends what companies should do now describes the background to the EU’s data export rules explains how the new SCCs differ from prior versions What…

Read More Using the new EU standard clauses to enable cross-border data export