How the Sausage Is Made (and Why “AI-Native” Is the New Snake Oil)
AI in legal practice accelerates research and drafting but cannot replace judgment. Why the AI-native law firm pitch misleads clients about what they are actually buying.
-
-
ICO Enforcement Guidance: Settlements, Discounts and the New Enforcement Playbook
The ICO has consulted on draft enforcement procedural guidance introducing a formal settlement procedure with penalty discounts of up to 40%, compulsory interview powers and approved person reports under the DUAA 2025.
-
Copyright and AI: The Government Steps Back from a Training Exception
Quick answer. The UK government confirmed on 18 March 2026 that it will not introduce a broad copyright exception for AI training. Instead, the existing copyright framework applies: AI developers must obtain licences to use copyrighted works for training, unless a specific existing exception (such as non-commercial research under section 29A CDPA 1988) applies. The…
-
When is a Data Subject Access Request Abusive? The CJEU Draws the Line in Brillen Rottler
On 19 March 2026, the Court of Justice of the European Union handed down its judgment in Case C-526/24 Brillen Rottler, ruling that even a first-ever data subject access request can be refused as “excessive” under Article 12(5) of the EU GDPR where the controller demonstrates it was made with abusive intent. The decision matters…
-
The DUAA Takes Effect: New ICO Powers Meet a Tougher Enforcement Stance
The Data (Use and Access) Act 2025 commenced on 5 February 2026, reforming automated decision-making, expanding ICO enforcement powers, and raising PECR fines to UK GDPR levels. Combined with record enforcement activity in 2025 and a new settlement procedure, the ICO is better equipped and more willing to act. What regulated businesses need to do now.
-
Ofcom’s Connected Nations 2025: Rising Data Demand and the UK’s Rapid Shift to 5G Standalone
Quick answer. Ofcom’s Connected Nations 2025 report confirms UK mobile data usage rose 18% year-on-year, 5G standalone networks cover 83% of the UK population from at least one operator, full-fibre broadband reaches 78% of UK premises, and over one million households have stopped using a landline. The report is the primary independent data source for…
-
EU Digital Omnibus: simplification or new complexity for digital and AI regulation?
Quick answer. The European Commission has proposed a Digital Omnibus Regulation amending the GDPR, ePrivacy Directive, NIS2 and the Data Act, and repealing or consolidating several overlapping measures. The Commission’s Staff Working Document estimates annual administrative cost savings to business of over EUR 1.3bn once implemented. UK controllers processing EU residents’ data should track the…
-
When Regulators Regulate Themselves: The UK judiciary and data protection regulator (ICO) guidelines for internal AI use
Quick answer. The Judicial Office and the Information Commissioner’s Office have each published internal AI use guidelines for their own staff. The guidance is operational, not directed at industry. It illustrates the UK’s sectoral approach to AI governance: existing bodies publishing rules for their own use within their existing remits, rather than a horizontal AI…
-
Online Safety Act duties: what platforms must do now
In short: Online Safety Act duties apply in layers, as at 28 August 2026: every regulated service must assess and manage illegal content risk (Online Safety Act 2023, ss 9, 10, 26 and 27), services likely to be accessed by children are subject to children’s duties (ss 11, 12, 28 and 29), user-to-user services must…
-
The Data (Use and Access) Act 2025: What It Means for UK Businesses
The Data (Use and Access) Act 2025 (DUAA) introduces sweeping changes in UK data regimes, from smart-data schemes and digital verification services to amendments of the Data Protection Act 2018 and UK GDPR. Rob Bratby of bratby.law guides UK businesses through compliance, strategic opportunities, and contract implications. Essential reading for counsel, transaction teams and commercial leaders.
-
New UK data protection law proposals
Quick answer. In June 2022 the UK government set out proposals to reform UK data protection law across five areas: reducing barriers to responsible innovation, reducing burdens on business, boosting international data flows, delivering better public services, and reforming the ICO. These proposals became the Data Protection and Digital Information Bill, which was later reworked…
-
Personal data export from the UK
This article was published in March 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. In February 2022 the UK published two alternative sets of contracts for exporting personal data from the UK to non-adequate countries: the International Data…
