UK
Quick answer. The European Commission has proposed a Digital Omnibus Regulation amending the GDPR, ePrivacy Directive, NIS2 and the Data Act, and repealing or consolidating several overlapping measures. The Commission’s Staff Working Document estimates annual administrative cost savings to business of over EUR 1.3bn once implemented. UK controllers processing EU residents’ data should track the…
Quick answer. The Judicial Office and the Information Commissioner’s Office have each published internal AI use guidelines for their own staff. The guidance is operational, not directed at industry. It illustrates the UK’s sectoral approach to AI governance: existing bodies publishing rules for their own use within their existing remits, rather than a horizontal AI…
Quick answer. The Online Safety Act 2023 imposes a statutory duty of care on UK-accessible user-to-user services, search services and online publishers. Ofcom is the regulator and has moved into phased enforcement: illegal harms codes from March 2025, child safety codes from July 2025. Operators must classify their services, complete illegal harms and children’s access…
The Data (Use and Access) Act 2025 (DUAA) introduces sweeping changes in UK data regimes, from smart-data schemes and digital verification services to amendments of the Data Protection Act 2018 and UK GDPR. Rob Bratby of bratby.law guides UK businesses through compliance, strategic opportunities, and contract implications. Essential reading for counsel, transaction teams and commercial leaders.
Quick answer. The ICO is the lead UK regulator for AI where AI systems process personal data. Its remit flows from the UK GDPR and the Data Protection Act 2018, supplemented by the ICO Guidance on AI and data protection. Since the Data (Use and Access) Act 2025, the ICO also polices the amended Article…
UK AI Regulation: An overview Quick answer. The UK has no AI-specific statute. The 2023 White Paper set out five non-statutory principles (safety, appropriate transparency, fairness, accountability, contestability) and asks existing sector regulators (ICO, Ofcom, FCA, CMA, MHRA) to apply them within existing statutory frameworks. The Data (Use and Access) Act 2025 amended the UK…
This article was published in June 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights.
This article was published in June 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The Telecommunications (Security) Act 2021 amended the Communications Act 2003 to impose new network security duties on UK communications providers, with detailed requirements set…
This article was published in March 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. In February 2022 the UK published two alternative sets of contracts for exporting personal data from the UK to non-adequate countries: the International Data…
This article was published in September 2021 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The UK government published proposals on 10 September 2021 to reform UK data protection law, using post‑Brexit freedom to set separate UK rules. The…
This article was published in June 2021 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. On 28 June 2021, the EU Commission found that the UK provides adequate protection for personal data, enabling personal to freely flow from the EU (and…