UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: GPAI enforcement began on 2 August 2026. If you build a product on someone else’s AI model, the duties in Articles 53 to 55 of the EU AI Act apply to that supplier and not to you. They still matter, because they entitle you to information from your supplier, and because very substantial…
In short: The Information Commission is the statutory board that replaced the Information Commissioner as the UK data protection regulator on 30 September 2026. Section 117 of the Data (Use and Access) Act 2025, largely in force since 20 August 2025, established the Information Commission as a body corporate led by a chair, chief executive…
In short: The EDPB AMLA guidelines will set out how AML information sharing partnerships work under GDPR once Article 75 of the EU AML Regulation takes effect on 10 July 2027. The EDPB and AMLA announced the joint drafting project on 1 July 2026, with a draft consultation due in the first half of 2027….
In short: the AI transparency code of practice is now the EU-wide route to demonstrating compliance with Articles 50(2), (4) and (5) of the EU AI Act. The European Commission concluded on 8 July 2026 that the code is adequate, and the AI Board agreed on 9 July 2026. Signing is not a safe harbour,…
In short: Web scraping for AI training is lawful under the GDPR only where a data controller has a lawful basis for it, and in practice that means the three-part legitimate interest test in Article 6(1)(f). On 8 July 2026 the European Data Protection Board adopted draft guidelines on web scraping for generative AI, out…
In short: DRCF generative AI insights, published on 24 June 2026, show how the ICO, FCA, CMA and Ofcom govern their own use of generative AI: hallucination and bias controls, retrieval grounding, human review and evaluation frameworks. The same controls are the benchmark these regulators will expect of the firms they oversee when those firms…
In short: AI cyber risk is now a board responsibility, not an IT matter. The Five Eyes cyber security agencies, in a joint statement of 22 June 2026, told leaders to assess risk, fix foundational controls and prepare for incidents. For personal data, UK GDPR Article 32 and the accountability principle already make those expectations…
In short: The UK government will stop under-16s from holding social media accounts. It announced this under-16 social media ban on 15 June 2026, but the ban only takes effect through regulations under section 214A of the Online Safety Act 2023, due before Parliament by the end of 2026 and in force around Spring 2027….
In short: Consumer IoT data protection has two layers: UK GDPR sets the lawful basis for personal data, and PECR regulation 6 adds a separate consent layer wherever a connected product is “terminal equipment”. The ICO’s final IoT guidance, published 11 June 2026, confirms the test. Product security and market-access rules add third and fourth…
In short: AI Act transparency obligations apply from 2 August 2026 under Article 50 of Regulation (EU) 2024/1689. The European Commission published draft guidelines on 8 May 2026 explaining who must disclose chatbots, mark synthetic content and label deep fakes. Penalties reach €15 million or 3% of worldwide turnover. UK businesses serving EU users are…
In short: The EDPB data breach notification template, adopted in draft on 8 June 2026 and in public consultation until 5 August 2026, gives data controllers one structured form for notifying personal data breaches to EU supervisory authorities under Article 33 GDPR. UK reporting to the Information Commission is unchanged; the template matters where a…
In short: The Ofcom crisis response protocol, published on 9 June 2026, adds two measures to the Online Safety Act 2023 codes of practice. In-scope user-to-user services should prepare and apply a written crisis protocol, and large services should open a dedicated channel for law enforcement. The measures are recommended, not yet in force, and…