UK Data Protection
September 14, 2026
The Information Commissioner's Office published its Data Protection Fining Guidance on 18 March 2024 under section 160 of the Data Protection Act 2018. It explains when the regulator issues a penalty notice and how it reaches an amount, from a seriousness band through a turnover adjustment to a final check against the statutory cap. Both are set out here.
Read more →
UK Data Protection
September 7, 2026
The Data (Use and Access) Act 2025 is a nine-part statute covering smart data schemes, digital identity, buried pipes, birth registers, data protection, a new regulator and much else. Its commencement is the part most easily got wrong: Royal Assent brought almost none of it into force, and a reader working from the Act alone cannot tell what is law today.
Read more →
UK Data Protection
August 24, 2026
The UK did not write a data protection regulation of its own. It kept the EU text, substituted "the United Kingdom" for "the Union", and has been editing the result ever since. This guide covers the substitutions made in 2020, the rewrites the Data (Use and Access) Act 2025 made to Articles 6, 8A, 22 and 25, the "not materially lower" transfer test, and what the ICO has actually fined.
Read more →