UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: the ICO safe AI innovation plan, published on 29 May 2026, sells regulatory certainty, not deregulation. It answers the government’s January 2026 request for a plan by the end of May and builds on the June 2025 AI and biometrics strategy. It changes the ICO’s posture, not the law: for UK data controllers,…
In short: The UK AI Security Institute Australia MoU, signed in Canberra on 25 May 2026, deepens bilateral cooperation between the UK AI Security Institute (AISI) and the Australian AI Safety Institute on frontier AI evaluation, research and best practice. It does not change UK law and creates no new compliance duties for UK regulated…
In short: Agentic AI data protection in the UK is governed by UK GDPR Articles 22A to 22D, which permit solely automated significant decisions subject to the Article 22C safeguards. The safeguards apply at every sub-agent step. The data controller must control which sub-agents the orchestrator calls, hold a controller-to-processor contract under Article 28 for…
In short: Competition law and data protection are no longer enforced as separate regimes. The EDPB and the European Commission announced joint guidance work on 28 April 2026, the latest in the EDPB’s cross-regulatory programme. The UK reached the same starting point in May 2021 through the CMA-ICO joint statement and runs the convergence through…
In short: There are three priorities for the ICO in 2026: AI and biometrics strategy, the Children’s Code and their enforcement guidance. They all share one test: can the data controller show how each decision was made, and are the safeguards proportionate to the risk? By Rob Bratby, Managing Partner, Bratby Law. Lexology Global Elite…
In short: The European Commission’s first review of the Digital Markets Act, published on 28 April 2026 as COM(2026) 178 final under Article 53 of the Regulation, concludes that the law is working and proposes no legislative amendment. Cloud computing and AI are named as the next enforcement focus. The UK runs a separate regime…
In short: the draft EU merger guidelines data and digital deals reset puts ecosystem theories of harm, killer acquisitions and innovation competition at the centre of the substantive test, and introduces an Innovation Shield that protects most start-up acquisitions subject to conditions. The CMA reached similar ground in case practice on Microsoft Activision and Adobe…
DSIT Cyber Security Breaches Survey 2025/2026 published 30 April 2026: 47% of UK businesses use 2FA, 14% hold unprotected personal data, 25% have a formal incident response plan. What it means for Article 32 UK GDPR compliance and ICO enforcement.
In short: from 12 May 2026, ICO AI biometrics compliance moves to a statutory footing. SI 2026/425 comes into force on that date, placing the Information Commissioner under a statutory duty to write a single Code of Practice on artificial intelligence and automated decision-making, alongside live foundation-model and police facial recognition audit workstreams. By Rob…
In short: The Cyber Resilience Pledge is a voluntary DSIT scheme announced on 22 April 2026 inviting organisations to commit publicly to three actions: board-level cyber governance, registration with the NCSC Early Warning service, and Cyber Essentials across the supply chain. Signing crystallises a self-declared baseline against which the ICO can later assess UK GDPR…
In short: The UK adequacy decision for inbound EU personal data was renewed by the European Commission on 19 December 2025 and runs to 27 December 2031. UK controllers should rely on it as the primary inbound transfer mechanism but maintain Standard Contractual Clauses and IDTA fallback documentation against the Commission’s monitoring conditions and the…
In short: Section 166 DPA 2018 is the only route a data subject has to take the Information Commissioner to a tribunal over how she handles a complaint. McDonnell [2026] UKFTT 524 (GRC), 9 April 2026, confirms the tribunal can push the ICO to act, but cannot make it change its answer. DUAA 2025 does…