Data Protection

In short: DRCF generative AI insights, published on 24 June 2026, show how the ICO, FCA, CMA and Ofcom govern their own use of generative AI: hallucination and bias controls, retrieval grounding, human review and evaluation frameworks. The same controls are the benchmark these regulators will expect of the firms they oversee when those firms…

In short: AI cyber risk is now a board responsibility, not an IT matter. The Five Eyes cyber security agencies, in a joint statement of 22 June 2026, told leaders to assess risk, fix foundational controls and prepare for incidents. For personal data, UK GDPR Article 32 and the accountability principle already make those expectations…

In short: The UK government will stop under-16s from holding social media accounts. It announced this under-16 social media ban on 15 June 2026, but the ban only takes effect through regulations under section 214A of the Online Safety Act 2023, due before Parliament by the end of 2026 and in force around Spring 2027….

In short: Consumer IoT data protection has two layers: UK GDPR sets the lawful basis for personal data, and PECR regulation 6 adds a separate consent layer wherever a connected product is “terminal equipment”. The ICO’s final IoT guidance, published 11 June 2026, confirms the test. Product security and market-access rules add third and fourth…

In short: The Ofcom crisis response protocol, published on 9 June 2026, adds two measures to the Online Safety Act 2023 codes of practice. In-scope user-to-user services should prepare and apply a written crisis protocol, and large services should open a dedicated channel for law enforcement. The measures are recommended, not yet in force, and…

In short: The Data Use and Access Act 2025 commencement regulations (SI 2026/82) brought the principal data protection provisions into force on 5 February 2026. New Article 12A UK GDPR changes how the one-month DSAR period is calculated; Schedule 4 introduces five categories of recognised legitimate interest requiring no balancing test; Articles 22A to 22D replace the…

In short: The NCSC agentic AI guidance, published on 15 May 2026, describes the security controls expected of organisations deploying AI agents: least privilege, limited scope, temporary credentials, monitoring, threat modelling and incident plans, with named individuals accountable. For UK data controllers it helps determine what UK GDPR Article 32 requires of them, and it…

In short: AI consumer protection UK is being built without a standalone AI Act. On 3 June 2026 the Digital Regulation Cooperation Forum (DRCF), the joint forum of the ICO, FCA, CMA and Ofcom, opened a call for input on consumer interest and AI. It gathers the consumer evidence the four regulators need to apply…

In short: the ICO safe AI innovation plan, published on 29 May 2026, sells regulatory certainty, not deregulation. It answers the government’s January 2026 request for a plan by the end of May and builds on the June 2025 AI and biometrics strategy. It changes the ICO’s posture, not the law: for UK data controllers,…

In short: The UK AI Security Institute Australia MoU, signed in Canberra on 25 May 2026, deepens bilateral cooperation between the UK AI Security Institute (AISI) and the Australian AI Safety Institute on frontier AI evaluation, research and best practice. It does not change UK law and creates no new compliance duties for UK regulated…