UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: The Data (Use and Access) Act 2025 commencement regulations (SI 2026/82) brought the principal data protection provisions into force on 5 February 2026. New Article 12A UK GDPR changes how the one-month DSAR period is calculated; Schedule 4 introduces five categories of recognised legitimate interest requiring no balancing test; Articles 22A to 22D replace the…
In short: The NCSC agentic AI guidance, published on 15 May 2026, describes the security controls expected of organisations deploying AI agents: least privilege, limited scope, temporary credentials, monitoring, threat modelling and incident plans, with named individuals accountable. For UK data controllers it helps determine what UK GDPR Article 32 requires of them, and it…
In short: AI consumer protection UK is being built without a standalone AI Act. On 3 June 2026 the Digital Regulation Cooperation Forum (DRCF), the joint forum of the ICO, FCA, CMA and Ofcom, opened a call for input on consumer interest and AI. It gathers the consumer evidence the four regulators need to apply…
In short: the ICO safe AI innovation plan, published on 29 May 2026, sells regulatory certainty, not deregulation. It answers the government’s January 2026 request for a plan by the end of May and builds on the June 2025 AI and biometrics strategy. It changes the ICO’s posture, not the law: for UK data controllers,…
In short: The UK AI Security Institute Australia MoU, signed in Canberra on 25 May 2026, deepens bilateral cooperation between the UK AI Security Institute (AISI) and the Australian AI Safety Institute on frontier AI evaluation, research and best practice. It does not change UK law and creates no new compliance duties for UK regulated…
In short: Agentic AI data protection in the UK is governed by UK GDPR Articles 22A to 22D, which permit solely automated significant decisions subject to the Article 22C safeguards. The safeguards apply at every sub-agent step that takes a solely automated significant decision. The data controller must control which sub-agents the orchestrator calls, hold…
In short: Competition law and data protection are no longer enforced as separate regimes. The EDPB and the European Commission announced joint guidance work on 28 April 2026, the latest in the EDPB’s cross-regulatory programme. The UK reached the same starting point in May 2021 through the CMA-ICO joint statement and runs the convergence through…
In short: There are three priorities for the ICO in 2026: AI and biometrics strategy, the Children’s Code and their enforcement guidance. They all share one test: can the data controller show how each decision was made, and are the safeguards proportionate to the risk? By Rob Bratby, Managing Partner, Bratby Law. Lexology Global Elite…
In short: The King’s Speech 2026, delivered on 13 May 2026, announced two Bills that reach regulated firms: the Digital Access to Services Bill, which puts the government’s digital ID scheme on a statutory footing alongside Part 2 of the Data (Use and Access) Act 2025, and the European Partnership Bill, which legislates for closer…
In short: The European Commission’s first review of the Digital Markets Act, published on 28 April 2026 as COM(2026) 178 final under Article 53 of the Regulation, concludes that the law is working and proposes no legislative amendment. Cloud computing and AI are named as the next enforcement focus. The UK runs a separate regime…
In short: the draft EU merger guidelines data and digital deals reset puts ecosystem theories of harm, killer acquisitions and innovation competition at the centre of the substantive test, and introduces an Innovation Shield that protects most start-up acquisitions subject to conditions. The CMA reached similar ground in case practice on Microsoft Activision and Adobe…
DSIT Cyber Security Breaches Survey 2025/2026 published 30 April 2026: 47% of UK businesses use 2FA, 14% hold unprotected personal data, 25% have a formal incident response plan. What it means for Article 32 UK GDPR compliance and ICO enforcement.