UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: the Information Commission, which took over the Information Commissioner’s functions on 30 September 2026, is under a statutory duty to write a code of practice on artificial intelligence and automated decision-making. SI 2026/425 came into force on 12 May 2026 and imposes that duty. It binds the Commission, not controllers. It sits alongside…
In short: The Cyber Resilience Pledge is a voluntary DSIT scheme announced on 22 April 2026 inviting organisations to commit publicly to three actions: board-level cyber governance, registration with the NCSC Early Warning service, and Cyber Essentials across the supply chain. Signing crystallises a self-declared baseline against which the ICO can later assess UK GDPR…
In short: The UK adequacy decision for inbound EU personal data was renewed by the European Commission on 19 December 2025 and runs to 27 December 2031. UK controllers should rely on it as the primary inbound transfer mechanism but maintain Standard Contractual Clauses and IDTA fallback documentation against the Commission’s monitoring conditions and the…
In short: Section 166 DPA 2018 is the only route a data subject has to take the Information Commission (formerly the Information Commissioner) to a tribunal over how it handles a complaint. McDonnell [2026] UKFTT 524 (GRC), 9 April 2026, confirms the tribunal can push the ICO to act, but cannot make it change its…
In short: The ICO wrote to Meta in March 2026 over outsourced human review of audio-visual data captured by Ray-Ban Meta smart glasses. The enquiry tests controller/processor allocation under UK GDPR Article 28, lawful basis for AI training data, and whether the DUAA 2025 “meaningful human involvement” standard is met where reviewers validate AI outputs…
DSIT’s Compute Roadmap envisages £2bn of UK AI compute investment by 2030. The data protection regime that attaches to organisations building, procuring or operating that infrastructure is not in the Roadmap. This post sets out the four obligations under UK GDPR and DUAA 2025: DPIA, automated decision-making, international transfers, and Article 28 processor agreements.
After a year of testing frontier AI models and legal-specific platforms, the problem was not capability but structure. A law firm cannot be built around a model. It needs a method in which AI operates under controlled, auditable workflows, with the lawyer as the final gate.
The DSIT joint open letter on AI cyber threats, updated on 22 April 2026 alongside the Cyber Resilience Pledge, does not create new law. It sharpens how the ICO, Ofcom and FCA will judge existing Article 32 and sector security obligations.
FCA targeted support went live on 6 April 2026. The FCA/ICO joint statement of 11 December 2025 requires firms to get UK GDPR, PECR and Article 22 compliance in place before they send a single communication.
In short: The £500 million UK Sovereign AI Fund, launched on 16 April 2026, is a pump-primer, not a war chest. Individual US AI companies have closed single funding rounds at several times that figure in the past 18 months. The UK’s real pitch to AI founders is regulatory divergence. The Data (Use and Access)…
In short: On 14 April 2026 the EDPB published a standardised DPIA template, open for consultation until 9 June 2026, which all EU authorities will adopt as their standard template. This matters most to UK controllers who process EU residents’ data and so face both UK and EU supervision, where a DPIA built only to…
The Information Commissioner’s Office (ICO) opened consultation on 27 February 2026 on draft updated guidance for the research, archiving and statistics (RAS) provisions of UK data protection law. Responses close on 27 April 2026. The commercial novelty for controllers running long-lived datasets, AI training sets or public-interest archives is the new disproportionate effort exemption in…