UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
Section 103 of the DUAA introduces a statutory data protection complaints process for all controllers from 19 June 2026. For telecoms operators and payment firms, the obligation overlaps with existing Ofcom and FCA complaints regimes.
The ICO regulates UK data protection, freedom of information, electronic marketing and network security. Guide to ICO powers, penalties and enforcement under the DUAA 2025.
The DUAA 2025 introduces recognised legitimate interests as a new UK GDPR lawful basis. Analysis of the five Annex 1 purposes, the distinction from standard legitimate interests, UK/EU divergence, and commercial implications for data-driven businesses.
AI in legal practice accelerates research and drafting but cannot replace judgment. Why the AI-native law firm pitch misleads clients about what they are actually buying.
The ICO has consulted on draft enforcement procedural guidance introducing a formal settlement procedure with penalty discounts of up to 40%, compulsory interview powers and approved person reports under the DUAA 2025.
Quick answer. The UK government confirmed on 18 March 2026 that it will not introduce a broad copyright exception for AI training. Instead, the existing copyright framework applies: AI developers must obtain licences to use copyrighted works for training, unless a specific existing exception (such as non-commercial research under section 29A CDPA 1988) applies. The…
On 19 March 2026, the Court of Justice of the European Union handed down its judgment in Case C-526/24 Brillen Rottler, ruling that even a first-ever data subject access request can be refused as “excessive” under Article 12(5) of the EU GDPR where the controller demonstrates it was made with abusive intent. The decision matters…
The Data (Use and Access) Act 2025 commenced on 5 February 2026, reforming automated decision-making, expanding ICO enforcement powers, and raising PECR fines to UK GDPR levels. Combined with record enforcement activity in 2025 and a new settlement procedure, the ICO is better equipped and more willing to act. What regulated businesses need to do now.
Quick answer. Ofcom’s Connected Nations 2025 report confirms UK mobile data usage rose 18% year-on-year, 5G standalone networks cover 83% of the UK population from at least one operator, full-fibre broadband reaches 78% of UK premises, and over one million households have stopped using a landline. The report is the primary independent data source for…
Quick answer. The European Commission has proposed a Digital Omnibus Regulation amending the GDPR, ePrivacy Directive, NIS2 and the Data Act, and repealing or consolidating several overlapping measures. The Commission’s Staff Working Document estimates annual administrative cost savings to business of over EUR 1.3bn once implemented. UK controllers processing EU residents’ data should track the…
Quick answer. The Judicial Office and the Information Commissioner’s Office have each published internal AI use guidelines for their own staff. The guidance is operational, not directed at industry. It illustrates the UK’s sectoral approach to AI governance: existing bodies publishing rules for their own use within their existing remits, rather than a horizontal AI…
The Data (Use and Access) Act 2025 (DUAA) introduces sweeping changes in UK data regimes, from smart-data schemes and digital verification services to amendments of the Data Protection Act 2018 and UK GDPR. Rob Bratby of bratby.law guides UK businesses through compliance, strategic opportunities, and contract implications. Essential reading for counsel, transaction teams and commercial leaders.