UK
In short: AI Act transparency obligations apply from 2 August 2026 under Article 50 of Regulation (EU) 2024/1689. The European Commission published draft guidelines on 8 May 2026 explaining who must disclose chatbots, mark synthetic content and label deep fakes. Penalties reach €15 million or 3% of worldwide turnover. UK businesses serving EU users are…
In short: The EDPB data breach notification template, adopted in draft on 8 June 2026 and in public consultation until 5 August 2026, gives data controllers one structured form for notifying personal data breaches to EU supervisory authorities under Article 33 GDPR. UK reporting to the ICO is unchanged; the template matters where a breach…
In short: geographic market definition CMA practice asks where customers would switch if a hypothetical monopolist raised price by 5 to 10 per cent. The CMA’s 21 May 2026 Welltower decision found competition concerns in 30 local catchment areas. The CMA reaches the finding through postcode-level overlap mapping and drive-time isochrone analysis, a methodology that…
In short: Competition law and data protection are no longer enforced as separate regimes. The EDPB and the European Commission announced joint guidance work on 28 April 2026, the latest in the EDPB’s cross-regulatory programme. The UK reached the same starting point in May 2021 through the CMA-ICO joint statement and runs the convergence through…
In short: The European Commission’s first review of the Digital Markets Act, published on 28 April 2026 as COM(2026) 178 final under Article 53 of the Regulation, concludes that the law is working and proposes no legislative amendment. Cloud computing and AI are named as the next enforcement focus. The UK runs a separate regime…
In short: the draft EU merger guidelines data and digital deals reset puts ecosystem theories of harm, killer acquisitions and innovation competition at the centre of the substantive test, and introduces an Innovation Shield that protects most start-up acquisitions subject to conditions. The CMA reached similar ground in case practice on Microsoft Activision and Adobe…
EU Merger Guidelines telecoms reset: the draft elevates scale, innovation and resilience as procompetitive factors. What it means for UK M&A with EU jurisdiction.
DSIT Cyber Security Breaches Survey 2025/2026 published 30 April 2026: 47% of UK businesses use 2FA, 14% hold unprotected personal data, 25% have a formal incident response plan. What it means for Article 32 UK GDPR compliance and ICO enforcement.
In short: Section 166 DPA 2018 is the only route a data subject has to take the Information Commissioner to a tribunal over how she handles a complaint. McDonnell [2026] UKFTT 524 (GRC), 9 April 2026, confirms the tribunal can push the ICO to act, but cannot make it change its answer. DUAA 2025 does…
In short: Altnet PIA, the Openreach product that lets operators build using its ducts and poles, is not new. It has been a regulated wholesale input since 2010, and the Electronic Communications Code requires operators to consider sharing apparatus more broadly. Two recent moves progress those arrangements. INCA’s Infrastructure Sharing Framework formalises operator-to-operator duct, pole…
The CMA’s coordinated push against fake and misleading consumer reviews lands the new Part 3 direct enforcement powers in the DMCCA 2024 on the consumer reviews supply chain. Five cases opened on 27 March 2026 reach across that supply chain at the same time and signal that consumer review compliance is now a discrete deal due diligence item.
CityFibre’s intervention in the CMA’s nexfibre/Substantial inquiry turns on local market definition. Why that question shapes Phase 2 risk and the altnet consolidation pipeline.