UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: The European Data Protection Board published a standardised DPIA template on 14 April 2026, open for consultation until 9 June 2026. UK controllers processing EU residents’ data should review the template now. Its design-risk versus incident-risk framework offers a more rigorous structure than the ICO’s current screening checklist. By Rob Bratby, Managing Partner,…
The Information Commissioner’s Office (ICO) opened consultation on 27 February 2026 on draft updated guidance for the research, archiving and statistics (RAS) provisions of UK data protection law. Responses close on 27 April 2026. The commercial novelty for controllers running long-lived datasets, AI training sets or public-interest archives is the new disproportionate effort exemption in…
The UK has no standalone AI law. Unlike the European Union, which passed the AI Act in 2024, the UK has chosen a sector-led approach under which existing regulators apply existing law to AI systems within their remit. This article sets out what that means in practice in 2026: which statutes and regulators bind AI developers and deployers, what the DUAA 2025 changed for automated decision-making, where copyright law stands after the government stepped back from its proposed training exception, and how Ofcom, the FCA, the PSR and the CMA apply existing powers to AI.
The DUAA replaces Article 22 UK GDPR with a new ADM regime effective 5 February 2026. The default shifts from prohibition to permission with safeguards. The ICO consultation on draft ADM guidance closes 29 May 2026.
Section 103 of the DUAA introduces a statutory data protection complaints process for all controllers from 19 June 2026. For telecoms operators and payment firms, the obligation overlaps with existing Ofcom and FCA complaints regimes.
The ICO regulates UK data protection, freedom of information, electronic marketing and network security. Guide to ICO powers, penalties and enforcement under the DUAA 2025.
The DUAA 2025 introduces recognised legitimate interests as a new UK GDPR lawful basis. Analysis of the five Annex 1 purposes, the distinction from standard legitimate interests, UK/EU divergence, and commercial implications for data-driven businesses.
AI in legal practice accelerates research and drafting but cannot replace judgment. Why the AI-native law firm pitch misleads clients about what they are actually buying.
Ofcom opened a formal investigation into X over Grok AI deepfake imagery. The first major Online Safety Act enforcement action against a global platform tests the full range of OSA powers, from fines to business disruption measures.
The ICO has consulted on draft enforcement procedural guidance introducing a formal settlement procedure with penalty discounts of up to 40%, compulsory interview powers and approved person reports under the DUAA 2025.
In short: The UK government confirmed on 18 March 2026 that it will not introduce a broad copyright exception for AI training. Instead, the existing copyright framework applies: AI developers must obtain licences to use copyrighted works for training, unless a specific existing exception (such as non-commercial research under section 29A CDPA 1988) applies. The…
On 19 March 2026, the Court of Justice of the European Union handed down its judgment in Case C-526/24 Brillen Rottler, ruling that even a first-ever data subject access request can be refused as “excessive” under Article 12(5) of the GDPR where the controller demonstrates it was made with abusive intent. The decision matters because…