UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
Copyright and AI policy in the UK reached a turning point on 18 March 2026, when the government published its Report on Copyright and Artificial Intelligence, together with an economic impact assessment. Both were required by sections 135 to 137 of the Data (Use and Access) Act 2025. The report confirms what the UK’s creative…
On 19 March 2026, the Court of Justice of the European Union handed down its judgment in Case C-526/24 Brillen Rottler, ruling that even a first-ever data subject access request can be refused as “excessive” under Article 12(5) of the GDPR where the controller demonstrates it was made with abusive intent. The decision matters because…
The Data (Use and Access) Act 2025 commenced on 5 February 2026, reforming automated decision-making, expanding ICO enforcement powers, and raising PECR fines to UK GDPR levels. Combined with record enforcement activity in 2025 and a new settlement procedure, the ICO is better equipped and more willing to act. What regulated businesses need to do now.
Ofcom’s Connected Nations Rising Data Demand and the UK’s Rapid Shift to 5G Standalone Ofcom has released its 2025 Connected Nations UK Report, reporting increasing mobile data demand and use, and the rapid expansion of 5G standalone networks. Ofcom’s Connected Nations annual report provides objective information on the UK telecoms market for operators, vendors and…
EU Digital Omnibus: simplification or new complexity for digital and AI regulation? What has happened and why does it matter? The European Commission has proposed a Digital Omnibus Regulation to streamline elements of the EU’s digital legislative framework, including amendments to the GDPR, ePrivacy Directive, NIS2 and the Data Act, while repealing several existing measures…
UK Judges and ICO publish internal AI use guidelines In the UK’s rapidly developing AI governance landscape, two institutions have taken a decisive and self-reflective step. The Judiciary of England and Wales and the Information Commissioner’s Office (ICO) have both published their internal policies on the use of artificial intelligence. These are not external consultation papers or policy statements…
The Data (Use and Access) Act 2025 (DUAA) introduces sweeping changes in UK data regimes, from smart-data schemes and digital verification services to amendments of the Data Protection Act 2018 and UK GDPR. Rob Bratby of bratby.law guides UK businesses through compliance, strategic opportunities, and contract implications. Essential reading for counsel, transaction teams and commercial leaders.
UK AI Regulation: ICO’s Role How should businesses navigate AI compliance in the UK? In contrast to the EU’s broad, sector-agnostic AI Act, the UK has taken a different approach to AI regulation. The UK government has opted for a regulator-led, principles-based framework, asking existing sector regulators to oversee AI in their own domains, which…
UK AI Regulation: An overview Introduction In contrast to the overarching, prescriptive approach of the EU AI Act, the UK’s approach to regulating artificial intelligence (AI) is to focus on regulating the use of AI, rather than the underlying AI technology. The UK’s objective is to foster innovation whilst managing risks. 2023 UK AI Regulation…
Government sets out response to consultation Commentary Following its September 2021 consultation on reform of UK data protection law, on 23 June 2022 the UK government published its response and proposals to move forward. Whilst the proposals for a post-GDPR data protection law in the UK contain some sensible reforms and updates, it is clear…
UK sets out two alternatives to provide adequate contractual protection for the export of personal data from the UK What happened? In February 2022, the UK government published 2 alternative sets of contracts that can be used by organisations wishing to export personal data from the UK to countries that do not otherwise provide adequate…