UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: The UK government will stop under-16s from holding social media accounts. It announced this under-16 social media ban on 15 June 2026, but the ban only takes effect through regulations under section 214A of the Online Safety Act 2023, due before Parliament by the end of 2026 and in force around Spring 2027….
In short: Consumer IoT data protection has two layers: UK GDPR sets the lawful basis for personal data, and PECR regulation 6 adds a separate consent layer wherever a connected product is “terminal equipment”. The ICO’s final IoT guidance, published 11 June 2026, confirms the test. Product security and market-access rules add third and fourth…
In short: AI Act transparency obligations apply from 2 August 2026 under Article 50 of Regulation (EU) 2024/1689. The European Commission published draft guidelines on 8 May 2026 explaining who must disclose chatbots, mark synthetic content and label deep fakes. Penalties reach €15 million or 3% of worldwide turnover. UK businesses serving EU users are…
In short: The EDPB data breach notification template, adopted in draft on 8 June 2026 and in public consultation until 5 August 2026, gives data controllers one structured form for notifying personal data breaches to EU supervisory authorities under Article 33 GDPR. UK reporting to the ICO is unchanged; the template matters where a breach…
In short: The Ofcom crisis response protocol, published on 9 June 2026, adds two measures to the Online Safety Act 2023 codes of practice. In-scope user-to-user services should prepare and apply a written crisis protocol, and large services should open a dedicated channel for law enforcement. The measures are recommended, not yet in force, and…
In short: The Data Use and Access Act 2025 commencement regulations (SI 2026/82) brought the principal data protection provisions into force on 5 February 2026. New Article 12A UK GDPR changes how the one-month DSAR period is calculated; Schedule 4 introduces five categories of recognised legitimate interest requiring no balancing test; Articles 22A to 22D replace the…
In short: The NCSC agentic AI guidance, published on 15 May 2026, describes the security controls expected of organisations deploying AI agents: least privilege, limited scope, temporary credentials, monitoring, threat modelling and incident plans, with named individuals accountable. For UK data controllers it helps determine what UK GDPR Article 32 requires of them, and it…
In short: AI consumer protection UK is being built without a standalone AI Act. On 3 June 2026 the Digital Regulation Cooperation Forum (DRCF), the joint forum of the ICO, FCA, CMA and Ofcom, opened a call for input on consumer interest and AI. It gathers the consumer evidence the four regulators need to apply…
In short: the ICO safe AI innovation plan, published on 29 May 2026, sells regulatory certainty, not deregulation. It answers the government’s January 2026 request for a plan by the end of May and builds on the June 2025 AI and biometrics strategy. It changes the ICO’s posture, not the law: for UK data controllers,…
In short: The UK AI Security Institute Australia MoU, signed in Canberra on 25 May 2026, deepens bilateral cooperation between the UK AI Security Institute (AISI) and the Australian AI Safety Institute on frontier AI evaluation, research and best practice. It does not change UK law and creates no new compliance duties for UK regulated…
In short: Agentic AI data protection in the UK is governed by UK GDPR Articles 22A to 22D, which permit solely automated significant decisions subject to the Article 22C safeguards. The safeguards apply at every sub-agent step. The data controller must control which sub-agents the orchestrator calls, hold a controller-to-processor contract under Article 28 for…
In short: Competition law and data protection are no longer enforced as separate regimes. The EDPB and the European Commission announced joint guidance work on 28 April 2026, the latest in the EDPB’s cross-regulatory programme. The UK reached the same starting point in May 2021 through the CMA-ICO joint statement and runs the convergence through…