Regulatory Updates

UK data protection updates that matter to your business

Follow important developments across UK GDPR, PECR, ICO guidance, direct marketing, online tracking and AI-related data protection. Each update explains what changed, who may be affected and what your business should review next.

Regulatory change, filtered for business relevance

Use this hub to see what deserves attention now, catch up on recent developments and keep important areas of privacy and data protection on your radar.

Latest Updates

Recent developments

Recent privacy and data protection developments, with a quick explanation of why each one may be useful to understand from a business perspective.

August 2026 • Disclosure Failures / Governance

Metropolitan Police issued enforcement notice after data protection failures

The ICO issued an enforcement notice and reprimand after serious disclosure incidents involving sensitive personal information, redaction failures and bulk email risks.

Why it matters: the case highlights practical risks around disclosures, checking information before it is shared and preventing avoidable human error.
Read Update
August 2026 • Cyber Security / UK GDPR

ACRO reprimanded following cyber security failings

The ICO reprimanded ACRO after cyber security failings left personal information relating to thousands of people potentially exposed.

Why it matters: the case reinforces the importance of maintaining security controls, keeping systems updated and making responsibility for cyber risk clear.
Read Update
What to Watch On the Radar

Areas worth keeping under review

These are areas where regulatory activity, guidance or enforcement may continue to affect the way businesses approach privacy and data protection.

SME data protection training The ICO has launched free Data Protection Essentials training for small organisations and sole traders. What businesses can consider now: decide which staff need basic data protection training and how it should fit into onboarding or refresher training.
Cyber security and supplier accountability Recent ICO action continues to highlight patching, supplier oversight, security monitoring and responsibility for protecting personal information. What businesses can consider now: check who owns updates, supplier reviews, security alerts and incident escalation.
Direct marketing and PECR Calls, emails, texts, cookies, consent evidence and marketing preferences remain important areas of regulatory attention. What businesses can consider now: review consent records, soft opt-in use, unsubscribe routes and suppression controls.
AI and automated decision-making Data protection issues involving AI, profiling, automated scoring and decision-support tools continue to develop. What businesses can consider now: understand which AI and automated tools are being used and what personal information they process.
Future Implementation Support Waitlist