UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: On 30 October 2026 the High Court rejected the claims by Meta and WhatsApp, X and TikTok UK against the Ofcom information notices issued on 10 February 2026, refusing permission on most grounds and dismissing the proportionality and human rights grounds on their merits. A provider can challenge an Ofcom information notice under…
NCSC AI cyber intrusion assessment of 3 November 2026: what its judgements to 2028 mean for the Article 32 UK GDPR security duty of data controllers.
Energy smart data under the DUAA: DESNZ’s proposals compared with telecoms, water, road fuel and open banking, through the potential consumer detriment in each market.
In short: The EU KIDS Act, which the European Commission proposed on 17 September 2026, would bar under-15s from social media accounts in the EU and require platforms to check age through a certified EU solution using zero-knowledge proof. The Online Safety Act 2023 sets an outcome standard instead, so a service with UK and…
In short: Digital verification services fall under Part 2 of the Data (Use and Access) Act 2025, in force since 1 December 2025. Version 1.0 of the trust framework took effect on 2 September 2026. From 1 October 2026 an employer or landlord who checks identity digitally must use a provider on the statutory register….
The EU AI Act explained for UK businesses: what already applies, the high-risk dates moved to 2027 and 2028 by the Digital Omnibus, penalties and the authorised representative duty.
In short: three tests answer “does the Online Safety Act apply to my service?” as at 28 August 2026: whether the service enables user-generated content, includes a search engine or publishes pornographic content (ss 3 and 80); whether it has links with the UK (s 4, or s 80(4) for pornography providers); and whether an…
In short: the Digital Omnibus on AI, Regulation (EU) 2026/1744, has been in force since 27 July 2026. It moves the EU AI Act’s high-risk obligations to 2 December 2027 for AI in listed uses such as recruitment and credit scoring, and to 2 August 2028 for AI built into a regulated product. The Article…
In short: Bulk email data protection falls within the security duty in section 40 of the Data Protection Act 2018, which the Information Commissioner applied to the Metropolitan Police in a reprimand and enforcement notice dated 27 July 2026. Telling staff to use BCC was not a sufficient measure, and unevidenced training infringed section 40…
In short: the objective test for data subject consent means a data controller proves consent by what the data subject did, not by what was in their mind. In RTM v Bonne Terre [2026] EWCA Civ 488, handed down on 21 April 2026, the Court of Appeal reversed the subjective test the High Court had…
In short: The ICO’s reprimand for cyber security failings, issued to ACRO Criminal Records Office on 7 August 2026, turns on named ownership of patch management and monitoring of security alerts under UK GDPR Article 32. A hacker held access to ACRO’s website for seven months, exposing sensitive data for up to 10,920 people. The…
In short: AI Office enforcement covers a company only where it built the AI system on its own general-purpose AI model, or where the system operates inside a platform designated under the Digital Services Act. Every other business remains subject to national regulation. The difference matters, because the AI Office can enter and seal premises…