Government policy
The DUAA 2025 introduces recognised legitimate interests as a new UK GDPR lawful basis. Analysis of the five Annex 1 purposes, the distinction from standard legitimate interests, UK/EU divergence, and commercial implications for data-driven businesses.
FCA safeguarding reform is now weeks away from taking effect. The FCA published its Payments Regulatory Priorities report on 25 March 2026, confirming that keeping customers’ money safe remains its primary concern for the payments sector. The message to payment institutions and electronic money institutions is direct: the Safeguarding Supplementary Regime takes effect on 7…
On 26 February 2026, the Payments Vision Delivery Committee published the Payments Forward Plan, the first coordinated regulatory roadmap for UK payments since the National Payments Vision in November 2024. The Plan sets out what the Bank of England, the FCA, the PSR and HM Treasury intend to do across retail payments, wholesale payments and…
EU Digital Omnibus: simplification or new complexity for digital and AI regulation? What has happened and why does it matter? The European Commission has proposed a Digital Omnibus Regulation to streamline elements of the EU’s digital legislative framework, including amendments to the GDPR, ePrivacy Directive, NIS2 and the Data Act, while repealing several existing measures…
The Data (Use and Access) Act 2025 (DUAA) introduces sweeping changes in UK data regimes, from smart-data schemes and digital verification services to amendments of the Data Protection Act 2018 and UK GDPR. Rob Bratby of bratby.law guides UK businesses through compliance, strategic opportunities, and contract implications. Essential reading for counsel, transaction teams and commercial leaders.
On 17 November 2021, the Telecoms (Security) Act 2021, amending the Communications Act 2003, imposed new telecoms security obligations on UK communications providers. These telecoms security obligations represent a significant expansion of the regulatory framework, requiring providers to take active steps to manage network security risks. The legislation: Editorial note (April 2026): The Telecommunications (Security)…
UK sets out two alternatives to provide adequate contractual protection for the export of personal data from the UK What happened? In February 2022, the UK government published 2 alternative sets of contracts that can be used by organisations wishing to export personal data from the UK to countries that do not otherwise provide adequate…
UK data protection law: key proposed changes What is proposed? On 10 September 2021, the UK government published its proposals to reform UK data protection law. While current UK data protection law in the form of UK GDPR mirrors EU data protection law, the proposals represent the UK government seizing the opportunity given by Brexit…
On 28 June 2021, the EU Commission found that the UK provides adequate protection for personal data, enabling personal to freely flow from the EU (and EEA) to the UK. Editorial note (April 2026): The EU adequacy decision for the UK was adopted on 28 June 2021 for a period of four years, expiring on…
Summary By the end of 2021, many corporate transactions in the communications, data infrastructure, artificial intelligence, satellite and space technologies sectors (and some others) will be subject to mandatory notification to, and national security review by, the UK government. Implementation timetable The National Security and Investment Act 2021 (“Act“) became part of UK law on…