UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: There are three priorities for the ICO in 2026: AI and biometrics strategy, the Children’s Code and their enforcement guidance. They all share one test: can the data controller show how each decision was made, and are the safeguards proportionate to the risk? By Rob Bratby, Managing Partner, Bratby Law. Lexology Global Elite…
In short: The European Commission’s first review of the Digital Markets Act, published on 28 April 2026 as COM(2026) 178 final under Article 53 of the Regulation, concludes that the law is working and proposes no legislative amendment. Cloud computing and AI are named as the next enforcement focus. The UK runs a separate regime…
In short: the draft EU merger guidelines data and digital deals reset puts ecosystem theories of harm, killer acquisitions and innovation competition at the centre of the substantive test, and introduces an Innovation Shield that protects most start-up acquisitions subject to conditions. The CMA reached similar ground in case practice on Microsoft Activision and Adobe…
DSIT Cyber Security Breaches Survey 2025/2026 published 30 April 2026: 47% of UK businesses use 2FA, 14% hold unprotected personal data, 25% have a formal incident response plan. What it means for Article 32 UK GDPR compliance and ICO enforcement.
In short: from 12 May 2026, ICO AI biometrics compliance moves to a statutory footing. SI 2026/425 comes into force on that date, placing the Information Commissioner under a statutory duty to write a single Code of Practice on artificial intelligence and automated decision-making, alongside live foundation-model and police facial recognition audit workstreams. By Rob…
In short: The Cyber Resilience Pledge is a voluntary DSIT scheme announced on 22 April 2026 inviting organisations to commit publicly to three actions: board-level cyber governance, registration with the NCSC Early Warning service, and Cyber Essentials across the supply chain. Signing crystallises a self-declared baseline against which the ICO can later assess UK GDPR…
In short: The UK adequacy decision for inbound EU personal data was renewed by the European Commission on 19 December 2025 and runs to 27 December 2031. UK controllers should rely on it as the primary inbound transfer mechanism but maintain Standard Contractual Clauses and IDTA fallback documentation against the Commission’s monitoring conditions and the…
In short: Section 166 DPA 2018 is the only route a data subject has to take the Information Commissioner to a tribunal over how she handles a complaint. McDonnell [2026] UKFTT 524 (GRC), 9 April 2026, confirms the tribunal can push the ICO to act, but cannot make it change its answer. DUAA 2025 does…
In short: The ICO wrote to Meta in March 2026 over outsourced human review of audio-visual data captured by Ray-Ban Meta smart glasses. The enquiry tests controller/processor allocation under UK GDPR Article 28, lawful basis for AI training data, and whether the DUAA 2025 “meaningful human involvement” standard is met where reviewers validate AI outputs…
DSIT’s Compute Roadmap envisages £2bn of UK AI compute investment by 2030. The data protection regime that attaches to organisations building, procuring or operating that infrastructure is not in the Roadmap. This post sets out the four obligations under UK GDPR and DUAA 2025: DPIA, automated decision-making, international transfers, and Article 28 processor agreements.
After a year of testing frontier AI models and legal-specific platforms, the problem was not capability but structure. A law firm cannot be built around a model. It needs a method in which AI operates under controlled, auditable workflows, with the lawyer as the final gate.
The DSIT joint open letter on AI cyber threats, updated on 22 April 2026 alongside the Cyber Resilience Pledge, does not create new law. It sharpens how the ICO, Ofcom and FCA will judge existing Article 32 and sector security obligations.