UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
UK AI Regulation: An overview Quick answer. The UK has no AI-specific statute. The 2023 White Paper set out five non-statutory principles (safety, appropriate transparency, fairness, accountability, contestability) and asks existing sector regulators (ICO, Ofcom, FCA, CMA, MHRA) to apply them within existing statutory frameworks. The Data (Use and Access) Act 2025 amended the UK…
This article was published in June 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights.
This article was published in March 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. In February 2022 the UK published two alternative sets of contracts for exporting personal data from the UK to non-adequate countries: the International Data…
This article was published in September 2021 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The UK government published proposals on 10 September 2021 to reform UK data protection law, using post‑Brexit freedom to set separate UK rules. The…
This article was published in June 2021 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. On 28 June 2021, the EU Commission found that the UK provides adequate protection for personal data, enabling personal to freely flow from the EU (and…
This article was published in June 2021 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. From 27 June 2021 exporters of personal data from the EU to third countries could adopt the new EU Standard Contractual Clauses under Commission…
EU progresses revised ePrivacy Regulation
This article was published in November 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The European Data Protection Board’s recommendations of 10 November 2020 set out a six‑step method for assessing whether personal data can be transferred outside…
This article was published in November 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. On 10 November, the European Data Protection Board adopted a recommendation on supplemental measures which might be used to ensure compliance with the EU level of…
This article was published in September 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The European Data Protection Board’s updated guidance of 7 September 2020 refined the tests for distinguishing controllers from processors under GDPR Articles 4, 24,…
This article was published in August 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The EU Commission and US Department of Commerce announced on 10 August 2020 that they had started talks on a successor to the invalidated…
This article was published in July 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. After Schrems II, exporters of personal data from the EU to the US and other third countries must rely on an alternative Article 46…