UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
In short: The ICO wrote to Meta in March 2026 over outsourced human review of audio-visual data captured by Ray-Ban Meta smart glasses. The enquiry tests controller/processor allocation under UK GDPR Article 28, lawful basis for AI training data, and whether the DUAA 2025 “meaningful human involvement” standard is met where reviewers validate AI outputs…
In short: There is no UK AI Act. UK AI regulation sits on the UK GDPR (as amended by the Data (Use and Access) Act 2025, in force 5 February 2026), sector regulators applying their existing rules (ICO, Ofcom, FCA), and DSIT policy direction. For clients with EU exposure the EU AI Act applies in…
DSIT’s Compute Roadmap envisages £2bn of UK AI compute investment by 2030. The data protection regime that attaches to organisations building, procuring or operating that infrastructure is not in the Roadmap. This post sets out the four obligations under UK GDPR and DUAA 2025: DPIA, automated decision-making, international transfers, and Article 28 processor agreements.
After a year of testing frontier AI models and legal-specific platforms, the problem was not capability but structure. A law firm cannot be built around a model. It needs a method in which AI operates under controlled, auditable workflows, with the lawyer as the final gate.
The DSIT joint open letter on AI cyber threats, updated on 22 April 2026 alongside the Cyber Resilience Pledge, does not create new law. It sharpens how the ICO, Ofcom and FCA will judge existing Article 32 and sector security obligations.
FCA targeted support went live on 6 April 2026. The FCA/ICO joint statement of 11 December 2025 requires firms to get UK GDPR, PECR and Article 22 compliance in place before they send a single communication.
In short: The £500 million UK Sovereign AI Fund, launched on 16 April 2026, is a pump-primer, not a war chest. Individual US AI companies have closed single funding rounds at several times that figure in the past 18 months. The UK’s real pitch to AI founders is regulatory divergence. The Data (Use and Access)…
In short: The European Data Protection Board published a standardised DPIA template on 14 April 2026, open for consultation until 9 June 2026. UK controllers processing EU residents’ data should review the template now. Its design-risk versus incident-risk framework offers a more rigorous structure than the ICO’s current screening checklist. By Rob Bratby, Managing Partner,…
The Information Commissioner’s Office (ICO) opened consultation on 27 February 2026 on draft updated guidance for the research, archiving and statistics (RAS) provisions of UK data protection law. Responses close on 27 April 2026. The commercial novelty for controllers running long-lived datasets, AI training sets or public-interest archives is the new disproportionate effort exemption in…
The UK has no standalone AI law. Unlike the European Union, which passed the AI Act in 2024, the UK has chosen a sector-led approach under which existing regulators apply existing law to AI systems within their remit. This article sets out what that means in practice in 2026: which statutes and regulators bind AI developers and deployers, what the DUAA 2025 changed for automated decision-making, where copyright law stands after the government stepped back from its proposed training exception, and how Ofcom, the FCA, the PSR and the CMA apply existing powers to AI.
The DUAA replaces Article 22 UK GDPR with a new ADM regime effective 5 February 2026. The default shifts from prohibition to permission with safeguards. The ICO consultation on draft ADM guidance closes 29 May 2026.
Section 103 of the DUAA introduces a statutory data protection complaints process for all controllers from 19 June 2026. For telecoms operators and payment firms, the obligation overlaps with existing Ofcom and FCA complaints regimes.