Data Protection
Specialist UK data protection advice for controllers, processors and technology businesses
A business that processes personal data must comply with the UK GDPR (as retained in UK law), the Data Protection Act 2018 and the amendments made by the Data (Use and Access) Act 2025. The Information Commission, still known as the ICO, enforces that framework. Bratby Law advises controllers, processors and technology businesses on lawful basis, DPIAs, international transfers, data protection for AI-enabled products and breach response. The Lexology Index recognises Rob Bratby as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection. Through four current fractional General Counsel appointments, Rob deals with operational compliance day to day.
A general counsel, data protection officer or in-house product lawyer needs a position on the lawful basis for each processing activity, the mechanism for each international transfer, whether a DPIA is required, and what the Data (Use and Access) Act 2025 changed about processing already under way. Advice on an AI-enabled product is data protection advice: whether the product is lawful depends on lawful basis, transparency, automated decision-making and DPIA, not on a separate body of law.
The regulatory framework
A controller must process personal data lawfully, fairly and transparently, collect it only for specified purposes, limit it to what is necessary, keep it accurate, keep it no longer than necessary, keep it secure, and be able to demonstrate that it has done so. Those are the core principles of the UK GDPR (as retained in UK law). Parliament made further provision in the Data Protection Act 2018 for law enforcement processing, intelligence services processing and the powers of the Information Commission. The Information Commission, which replaced the Information Commissioner on 30 September 2026 and still operates as the ICO, is the independent supervisory authority responsible for enforcement.
A controller must now comply with the UK data protection framework as amended by the Data (Use and Access) Act 2025. The principal amendments (lawful bases, automated decision-making and international transfers) commenced on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), which also commenced the complaints provisions on 19 June 2026. Parliament also used the Act to reform the ICO’s enforcement powers. A controller must maintain a complaints procedure and acknowledge a complaint within 30 days (new section 164A of the Data Protection Act 2018, in force since 19 June 2026). The ICO has published guidance for organisations on what the DUAA 2025 changed, updated on 19 June 2026 to record that all of the Act's data protection provisions are now in force. Its enforcement procedural guidance, which covers how it will use the new investigatory powers, remains in draft.
A business sending electronic marketing, setting cookies or processing traffic or location data must comply with the Privacy and Electronic Communications Regulations 2003 (PECR) as well as the UK GDPR. A telecoms operator must obtain consent to process location data for value-added services (regulation 14). The two sets of rules apply separately: a lawful basis under the UK GDPR does not satisfy a consent requirement under PECR.
The wider UK position on AI, including copyright, the EU AI Act and the sector-led approach taken by Ofcom, the FCA, the PSR and the CMA, is set out at UK AI Regulation: What the Law Actually Says.
Data protection advice
The obligations below arise across the life of a processing activity, from choosing a lawful basis to notifying a breach.
Why data protection matters
In my view the Information Commission increasingly directs its enforcement at systemic failures rather than isolated incidents. Under the DUAA 2025 the Information Commission has wider powers, including a power to compel a witness to attend an interview and a power to require reports from approved persons, and controllers have new obligations covering children's online services and complaint handling. A controller that treats data protection as a compliance function separate from how its products are designed risks enforcement action, delay to a transaction and damage to its reputation. The DUAA 2025 amendments sit inside the UK GDPR, the Data Protection Act 2018 and PECR, so a controller must read each of those instruments as amended, and must still satisfy the UK GDPR and PECR separately on the same processing.
Regulator, operator and advisor perspectives
On every data protection instruction we draw on three perspectives: the regulator’s, the operator’s and the advisor’s. Rob spent a year on secondment to Oftel and saw how a regulator writes, interprets and enforces its own rules; he draws on that in dealing with the ICO. Through four current fractional General Counsel appointments he sees how organisations process personal data in practice, with live vendor relationships and live regulatory risk. He brings more than 30 years in private practice and in senior in-house roles at UK telecoms operators, including that secondment, and since 2020 at Bratby Law, to advice on DPIAs, international transfers, breach response, data protection for AI-enabled products and data commercialisation in the telecoms, payments and technology sectors. He also knows from that background where data protection and sector-specific regulation meet. How the three perspectives combine is explained on Why Bratby Law.
Our data protection credentials
The Lexology Index recognises Rob Bratby as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection. Chambers UK ranks Bratby Law in Band 2 for Telecommunications. Rob holds four current fractional General Counsel appointments at regulated businesses, so he deals with operational compliance day to day.
Specialist boutique compared with a general privacy practice
We set out below what Bratby Law adds when we work alongside a law firm’s corporate or privacy team: regulatory experience, sector depth, who does the work and cost. On a transaction with a data-heavy target, we work with the instructing firm’s corporate team on lawful basis, processor arrangements, international transfers and the data protection warranties. See Transactions co-counsel.
| Factor | Bratby Law | Alongside a law firm’s team |
|---|---|---|
| Regulatory insider perspective | Rob was seconded to Oftel and holds four current fractional GC appointments, so he knows how regulators design and enforce their rules. | The instructing firm gains a view of how regulators and operating businesses approach the point, without building it for one matter. |
| Sector focus and depth | Rob advises on data protection alongside telecoms, payments and technology regulation, and on how PECR, FCA requirements and Ofcom obligations interact with the UK GDPR. | The firm’s privacy or corporate team keeps the general data protection work; we add the telecoms, payments and PECR overlay. |
| Senior partner delivery | Rob Bratby, Managing Partner, with more than 30 years’ experience, gives the advice himself and does not delegate it to junior associates. | The instructing team keeps conduct of the matter; one senior specialist covers the regulatory points and reports to the lead partner. |
| Cost and engagement flexibility | We charge a fixed fee for the initial regulatory review, and offer fractional GC arrangements for ongoing data protection support. | We act white-label or under our own name, and the instructing firm keeps the client relationship. |
Recent data protection insights
- Energy smart data and potential consumer detriment
- EU KIDS Act: one age check will not satisfy EU and UK rules
- Digital verification services: digital ID was cancelled, this deadline was not
How we work
Bratby Law advises clients directly on specific matters as direct legal advisors, supports other legal teams as specialist co-counsel, and takes longer-term retained appointments as fractional general counsel. In each case a partner does the work; nothing is delegated.
Specialist data protection advice
For data protection advice on AI-enabled products, see the TelXL case study; for UK GDPR compliance across consumer services, see the Core Communication case study.
Frequently asked questions about data protection
Has the Data (Use and Access) Act 2025 changed my data protection obligations?
Yes. The DUAA 2025 amends the UK GDPR framework. The changes include reforms to the enforcement powers of the Information Commission, a statutory complaints handling obligation requiring controllers to maintain a procedure and acknowledge complaints within 30 days, and modifications to international transfer provisions. A controller must check its lawful bases, its complaints procedure and its transfer mechanisms against the amended text.
How has enforcement by the Information Commission changed?
The Information Commission has wider powers under the DUAA 2025, and the ICO has said that it will use the new investigatory powers where necessary for the most serious cases while its enforcement procedural guidance is still in draft. In my view the areas most exposed are inadequate DPIAs, unlawful international transfers and insufficient technical measures. A controller should test its own DPIAs, transfer mechanisms and security measures against them.
Do I need separate UK and EU data protection compliance?
If you process personal data of UK and EU residents, you need to comply with both the UK GDPR and the EU GDPR. The regimes are diverging. Some DUAA 2025 changes apply only in the UK. Where the two regimes differ, a controller must satisfy each of them on its own terms.
Is AI governance a separate compliance requirement?
No. AI governance is part of data protection compliance. A controller that trains a model on personal data or takes automated decisions must establish a lawful basis under the UK GDPR, comply with Articles 22A to 22D where a significant decision about a person is taken solely by automated processing, and carry out a DPIA where the processing is likely to result in a high risk.
When should I instruct external data protection counsel?
Instruct external counsel when the matter carries regulatory risk that your in-house team cannot assess on its own. Common examples are investigations by the Information Commission, high-risk DPIAs, international transfer structuring, data breach response, and integration of data processing arrangements in M&A.
What does the new complaints handling obligation require?
Under section 164A of the Data Protection Act 2018, a controller must facilitate the making of data protection complaints, for example by providing a complaint form that can be completed electronically, acknowledge receipt of a complaint within 30 days, and then without undue delay take appropriate steps to respond and tell the complainant the outcome. Only the acknowledgement carries a fixed period. Where a controller fails to comply, the Information Commission can serve an enforcement notice under section 149(5A) of that Act.
How does the DUAA affect DPIAs?
It does not change the DPIA obligation. Parliament left Article 35 and Article 36 UK GDPR substantively unchanged in the DUAA 2025, so a controller must still carry out a DPIA before processing that is likely to result in a high risk, and must still consult the Information Commission under Article 36 where a high residual risk cannot be mitigated. The surrounding law a DPIA has to describe has changed, in particular the lawful bases and the automated decision-making provisions, and the ICO's DPIA guidance is under review for that reason.
What data protection issues arise in telecoms and payments transactions?
When a buyer acquires a telecoms operator or payment service provider, the controller relationship changes. On data migration the buyer must put new processor agreements in place, may need to carry out DPIAs, and must re-establish international transfer mechanisms. For telecoms data, the buyer must also meet the sector-specific requirements of PECR.
Also see
For where data protection meets other areas, see the Telecoms Regulation, Payments Regulation, Transactions and Digital Regulation pages. For the engagement models, see How We Work; for commentary on current developments, see Insights.
Some clients retain Rob Bratby as their fractional general counsel for longer-term specialist regulatory support.
Independent directory rankings
Our specialist expertise is recognised in major independent legal directories:
- Chambers & Partners: Rob Bratby is ranked as a Band 2 lawyer in the UK Guide 2026 in the “Telecommunications” category: Chambers
- Lexology: Rob Bratby is recognised in the Lexology Index as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection: Lexology
