Plain-English coverage of UK data protection news, the Data (Use and Access) Act 2025, and what it means for your organisation.
Schools and trusts handle a lot of personal data and a steady stream of concerns from parents and staff. The data protection complaints duty applies to them too. Here is what to put in place.
A plain-English round-up of the Data (Use and Access) Act so far: what has already taken effect, what is still coming, and the short list of things a UK business should do now.
Every UK organisation must have a way to take data protection complaints and must acknowledge them within 30 days. It applies whether you employ five people or five thousand. Here is what you actually need in place.
The Information Commissioner's Office is being reshaped into the Information Commission, run by a board rather than a single commissioner. Here is what is changing, what is staying the same, and why it should not change anything you do today.
Some low-risk cookies no longer need a consent pop-up. The ICO finalised its guidance on 29 April 2026. Here is what is now exempt, what still needs consent, and how to update your banner without getting it wrong.
The ICO fined Reddit £14.47m over children's data and weak age checks. Even if you are nowhere near social media, the case signals how the regulator now thinks. Here is what it means for any business that might collect data from under-18s.
There is an additional lawful reason to use personal data, and for a short list of purposes it skips the usual balancing test. Here is what 'recognised legitimate interests' covers and where the shortcut does and does not apply.
The old near-ban on fully automated decisions about people has been replaced by a system of safeguards. If you use software or AI to make decisions about customers or staff, here is what changed and what you must now put in place.
The maximum fine for breaking the UK's cookie and electronic marketing rules has jumped from £500,000 to £17.5m. Here is what changed, why it matters even to small businesses, and the cheap fixes that remove most of the risk.
When someone asks for their data, you now only have to make a 'reasonable and proportionate' search, not an exhaustive one. Here is what that means day to day, and where the limit sits.
When someone asks for a copy of their data, you usually have one month to respond. You can pause that month while you confirm who they are or check what they want. Here is how the 'stop the clock' rule works in practice.
The regulator has been overhauling how it decides fines, including offering discounts for settling early. Here is what the new approach means, and why cooperating quickly is now worth real money.
The main data protection changes in the Data (Use and Access) Act took effect on 5 February 2026. Here are the seven that matter most for an ordinary UK business, in plain language, with what each one means in practice.
If your business uses cloud tools or suppliers based abroad, your data is travelling. New guidance from January 2026 introduces a clearer 'data protection test'. Here is what it means without the jargon.
The European Commission renewed the UK's data adequacy on 19 December 2025, so personal data keeps flowing freely between the UK and Europe. Here is what the renewal covers, the catch in the small print, and what it means for a UK business.