Data Protection

DSIT Cyber Security Breaches Survey 2025/2026 published 30 April 2026: 47% of UK businesses use 2FA, 14% hold unprotected personal data, 25% have a formal incident response plan. What it means for Article 32 UK GDPR compliance and ICO enforcement.

In short: Section 166 DPA 2018 is the only route a data subject has to take the Information Commissioner to a tribunal over how she handles a complaint. McDonnell [2026] UKFTT 524 (GRC), 9 April 2026, confirms the tribunal can push the ICO to act, but cannot make it change its answer. DUAA 2025 does…

In short: The ICO wrote to Meta in March 2026 over outsourced human review of audio-visual data captured by Ray-Ban Meta smart glasses. The enquiry tests controller/processor allocation under UK GDPR Article 28, lawful basis for AI training data, and whether the DUAA 2025 “meaningful human involvement” standard is met where reviewers validate AI outputs…

In short: There is no UK AI Act. UK AI regulation sits on the UK GDPR (as amended by the Data (Use and Access) Act 2025, in force 5 February 2026), sector regulators applying their existing rules (ICO, Ofcom, FCA), and DSIT policy direction. For clients with EU exposure the EU AI Act applies in…

DSIT’s Compute Roadmap envisages £2bn of UK AI compute investment by 2030. The data protection regime that attaches to organisations building, procuring or operating that infrastructure is not in the Roadmap. This post sets out the four obligations under UK GDPR and DUAA 2025: DPIA, automated decision-making, international transfers, and Article 28 processor agreements.

The DSIT joint open letter on AI cyber threats, updated on 22 April 2026 alongside the Cyber Resilience Pledge, does not create new law. It sharpens how the ICO, Ofcom and FCA will judge existing Article 32 and sector security obligations.