UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: the objective test for data subject consent means a data controller proves consent by what the data subject did, not by what was in their mind. In RTM v Bonne Terre [2026] EWCA Civ 488, handed down on 21 April 2026, the Court of Appeal reversed the subjective test the High Court had…
In short: The ICO’s reprimand for cyber security failings, issued to ACRO Criminal Records Office on 7 August 2026, turns on named ownership of patch management and monitoring of security alerts under UK GDPR Article 32. A hacker held access to ACRO’s website for seven months, exposing sensitive data for up to 10,920 people. The…
In short: AI Office enforcement covers a company only where it built the AI system on its own general-purpose AI model, or where the system operates inside a platform designated under the Digital Services Act. Every other business remains subject to national regulation. The difference matters, because the AI Office can enter and seal premises…
In short: GPAI enforcement began on 2 August 2026. If you build a product on someone else’s AI model, the duties in Articles 53 to 55 of the EU AI Act apply to that supplier and not to you. They still matter, because they entitle you to information from your supplier, and because very substantial…
In short: The Information Commission is the statutory board that will replace the Information Commissioner as the UK data protection regulator. Sections 117 to 119 of the Data (Use and Access) Act 2025 abolish the Commissioner as a corporation sole and vest its functions in a body corporate led by a chair, chief executive and…
In short: The EDPB AMLA guidelines will set out how AML information sharing partnerships work under GDPR once Article 75 of the EU AML Regulation takes effect on 10 July 2027. The EDPB and AMLA announced the joint drafting project on 1 July 2026, with a draft consultation due in the first half of 2027….
In short: the AI transparency code of practice is now the EU-wide route to demonstrating compliance with Articles 50(2), (4) and (5) of the EU AI Act. The European Commission concluded on 8 July 2026 that the code is adequate, and the AI Board agreed on 9 July 2026. Signing is not a safe harbour,…
In short: Web scraping for AI training is lawful under the GDPR only where a data controller has a lawful basis for it, and in practice that means the three-part legitimate interest test in Article 6(1)(f). On 8 July 2026 the European Data Protection Board adopted draft guidelines on web scraping for generative AI, out…
In short: DRCF generative AI insights, published on 24 June 2026, show how the ICO, FCA, CMA and Ofcom govern their own use of generative AI: hallucination and bias controls, retrieval grounding, human review and evaluation frameworks. The same controls are the benchmark these regulators will expect of the firms they oversee when those firms…
In short: AI cyber risk is now a board responsibility, not an IT matter. The Five Eyes cyber security agencies, in a joint statement of 22 June 2026, told leaders to assess risk, fix foundational controls and prepare for incidents. For personal data, UK GDPR Article 32 and the accountability principle already make those expectations…
In short: The UK government will stop under-16s from holding social media accounts. It announced this under-16 social media ban on 15 June 2026, but the ban only takes effect through regulations under section 214A of the Online Safety Act 2023, due before Parliament by the end of 2026 and in force around Spring 2027….
In short: Consumer IoT data protection has two layers: UK GDPR sets the lawful basis for personal data, and PECR regulation 6 adds a separate consent layer wherever a connected product is “terminal equipment”. The ICO’s final IoT guidance, published 11 June 2026, confirms the test. Product security and market-access rules add third and fourth…