Regulatory Updates

Clear regulatory updates for privacy, marketing and data protection.

A curated hub for important UK GDPR, PECR, direct marketing, AI regulation and compliance developments, explaining what has changed, why it matters, and what organisations should consider in practice.

Current Focus Latest Updates Looking Ahead

Regulatory developments, explained clearly

This page highlights the most relevant privacy, data protection, marketing, and AI developments, with clear summaries and practical context for businesses.

FEATURED UPDATE Most Important

ICO launches free data protection training for SMEs

Updated August 2026 • SME Compliance / Training

The ICO has launched free Data Protection Essentials training to help small organisations and sole traders understand practical data protection responsibilities.

What changed: the ICO has launched free training and self-assessment support for SMEs

Why it matters: staff need to understand how to handle personal information safely

Who may be affected: small organisations, sole traders and teams handling customer, employee or marketing data

What organisations should review: staff training, onboarding, records, security and data-handling responsibilities

Read full update View update archive

LATEST UPDATES Recent updates

Recent developments

Short summaries of the latest regulatory updates published across privacy, data protection, cyber security, AI, and related compliance areas.

August 2026 • Disclosure Failures / Governance

Metropolitan Police issued enforcement notice after data protection failures

The ICO issued an enforcement notice and reprimand after serious disclosure incidents involving sensitive personal information, redaction failures and bulk email risks.

Read update

August 2026 • Cyber Security / UK GDPR

ACRO reprimanded following cyber security failings

The ICO reprimanded ACRO after cyber security failings left personal information relating to thousands of people potentially exposed.

Read update

LOOKING AHEAD Next developments

Developments to watch

Key regulatory developments and guidance areas to keep under review over the coming months.

SME data protection training adoption The ICO has launched free Data Protection Essentials training for small organisations and sole traders. What to do now: consider whether staff who handle customer, employee or marketing data should complete basic training.

Cyber patching and supplier accountability Recent ICO action shows continued focus on patch management, supplier oversight, alerts and security monitoring. What to do now: confirm who is responsible for updates, alerts, supplier checks and incident escalation.

Direct marketing and PECR guidance Direct marketing compliance remains active, with continuing focus on calls, emails, texts, cookies and consent evidence. What to do now: review consent records, soft opt-in use, unsubscribe routes and suppression controls.

AI, ADM and foundation model guidance The ICO continues to develop guidance on automated decision-making, profiling, foundation models and agentic AI. What to do now: map AI tools, automated scoring, chatbots, profiling and decision-support systems.