United Kingdom

Regulator And AuthorityAmber

The ICO is the UK's independent regulator for data protection and information rights, with responsibilities under DPA 2018, UK GDPR, FOIA, EIR and PECR, among other statutes. The DUAA abolishes the office of Information Commissioner and transfers its functions to a new corporate body, the Information Commission, moving from a corporation-sole model to a chair/CEO/board structure.

Claims (3):

• The Information Commissioner's Office (ICO) is the UK's independent regulator for data protection and information rights law, with statutory responsibilities under the DPA 2018, UK GDPR, FOIA, EIR and PECR, among other acts.
• The DUAA 2025 abolishes the office of Information Commissioner and transfers its functions to a new body, the Information Commission, replacing the corporation-sole structure with a board-governed model.
• As of mid-2026, the ICO's transition to the board-governed Information Commission structure has not been assigned a confirmed final transition date; the current Commissioner is expected to become Chair, with a CEO and non-executive board being appointed.

Act And InstrumentsGreen

The operative instruments are UK GDPR, DPA 2018 and PECR 2003, amended but not replaced by the DUAA 2025.

Claims (1):

• The DUAA 2025 amends, but does not replace, UK GDPR, the DPA 2018 and PECR 2003.

Material ScopeGreen

UK GDPR/DPA 2018 apply to processing of personal data by controllers and processors; the DUAA makes targeted amendments to purpose limitation, research processing and lawful bases without expanding core material scope.

Claims (1):

• The DUAA restructures rather than materially changes the scope of what personal information organisations may use, clarifying legitimate interests, research processing and purpose limitation while preserving core UK GDPR/DPA 2018 material scope.

Territorial ScopeGreen

UK GDPR has extraterritorial reach equivalent to EU GDPR Article 3(2): non-UK controllers/processors offering goods/services to, or monitoring the behaviour of, UK data subjects fall within scope and generally must appoint a UK representative.

Claims (1):

• A UK company with active business ties to EU member states (and no EU establishment) may need to appoint an EU GDPR representative where its processing meets the Article 3(2)-equivalent destination-principle criteria, and the same logic applies to non-UK controllers targeting or monitoring UK data subjects under UK GDPR.

Regulator Registration And FilingGreen

Controllers processing personal data must generally pay an annual data protection fee to the ICO under the Data Protection (Charges and Information) Regulations 2018, across three tiers (£52/£78/£3,763), with over one million controllers on the public register.

Claims (2):

• Under the Data Protection (Charges and Information) Regulations 2018, organisations processing personal information must pay an annual data protection fee to the ICO across three tiers ranging from £52 to £3,763, unless exempt.
• The ICO maintains a public register of more than one million fee-paying data controllers, and failure to pay the required fee can result in a fixed penalty of up to £4,000.

Lawful BasesAmber

The DUAA introduces 'recognised legitimate interest' as a new UK GDPR lawful basis limited to an exhaustive statutory list (e.g., crime prevention, safeguarding, public security, emergencies) and unavailable to public authorities performing their tasks.

Claims (2):

• The DUAA 2025 introduces 'recognised legitimate interest' as a new UK GDPR lawful basis, separate from ordinary legitimate interests, limited to an exhaustive list of public-interest purposes such as crime prevention, safeguarding and emergencies.
• Recognised legitimate interest cannot be relied upon by public authorities performing their public tasks, which must continue to use the public task lawful basis.

Consent ThresholdsGreen

Consent-based processing for children under 13 continues to require parental/carer authorisation under the DPA 2018/UK GDPR consent provisions.

Claims (1):

• Where an online service relies on consent as its lawful basis, UK data protection law requires parental authorisation for children under 13.

Special CategoriesGreen

Article 9 special category conditions and DPA 2018 Schedule 1 additional conditions remain the operative framework, including for biometric data, with minor DUAA clarifications to crime, journalism and fraud exemption wording.

Claims (1):

• Processing biometric data for unique identification purposes constitutes special category processing under UK GDPR Article 9, requiring both an Article 6 lawful basis and a separate Article 9/DPA 2018 Schedule 1 condition, with explicit consent typically the most applicable condition.

Pseudonymisation And AnonymisationRed

No dedicated post-DUAA ICO code or statutory redefinition of pseudonymisation/anonymisation was located in this research pass; searches covered ICO guidance-and-resources indexes and DUAA summary pages without surfacing a standalone anonymisation instrument update.

Access RightGreen

The subject access request (SAR) regime continues under UK GDPR Article 15/DPA 2018, with the DUAA inserting a 'stopping the clock' provision allowing controllers to pause the response time limit when reasonably requesting clarification from the requester.

Claims (1):

• The DUAA 2025 inserts provisions into UK GDPR and DPA 2018 Part 3 allowing controllers to pause ('stop the clock') the SAR response time limit in order to request reasonably required clarification from the requester.

Rectification And ErasureAmber

Rectification and erasure rights under UK GDPR Articles 16-17 are unaffected in substance by the DUAA; no dedicated new instrument was located for this sub-module beyond the general 'no material change' framing in ICO's DUAA summary.

Claims (1):

• Most DUAA changes offer organisations optional flexibility rather than mandating specific changes to existing rectification/erasure obligations, meaning the substantive right to rectification and erasure is not materially altered.

Restriction And ObjectionGreen

Individuals retain an absolute right to object to processing for direct marketing purposes at any time, with a qualified right to object in other circumstances (e.g., public task, legitimate interests, research).

Claims (1):

• Individuals have an absolute right under UK GDPR Article 21 to stop their personal data being used for direct marketing, and controllers must inform individuals of this right at the latest at first communication.

Data PortabilityAmber

No DUAA-specific change to the Article 20 data portability right was identified in this research pass; the underlying UK GDPR Article 20 portability right is presumed to continue unamended, but this was not separately confirmed against a primary source in this run.

Deadlines And Response WindowsGreen

The standard one-month response window applies to rights requests including the right to object; the DUAA's 'stopping the clock' mechanism allows this to be paused for SARs pending clarification from the data subject.

Claims (2):

• Controllers have one calendar month to respond to a right-to-object request under UK GDPR.
• The DUAA 2025 inserts provisions into UK GDPR and DPA 2018 Part 3 allowing controllers to pause ('stop the clock') the SAR response time limit in order to request reasonably required clarification from the requester.

Accountability And DpiaAmber

Accountability requires documented compliance measures; DPIAs are required for high-risk processing including profiling and children's services. Failure to conduct a DPIA was a finding in both the Reddit and MediaLab enforcement actions.

Claims (3):

• Accountability is a UK GDPR principle requiring organisations to take responsibility for and demonstrate compliance, including through data protection by design/default, processor contracts, documented processing activities and DPIAs.
• The ICO's £14.47m fine against Reddit found the company failed to carry out a DPIA to assess and mitigate risks to children before January 2025.
• The ICO's £247,590 fine against MediaLab (Imgur) similarly found a failure to carry out a data protection impact assessment to identify and reduce privacy risks to children.

Dpo RequirementsGreen

Organisations required (or choosing) to appoint a DPO must notify the ICO; DPO contact details are published on the fee-payer register, with DPO tasks including advising on UK GDPR compliance, monitoring compliance and staff training.

Claims (2):

• Where an organisation has appointed a DPO, the DPO's contact details (and name, with consent) are published on the ICO's public register of fee payers.
• A DPO's tasks include advising the organisation about UK GDPR compliance, monitoring compliance and training staff.

Ropa RequirementsAmber

Accountability guidance requires maintaining documentation of processing activities as part of demonstrating UK GDPR compliance; a dedicated post-DUAA ROPA-specific instrument was not separately identified in this research pass beyond the general accountability guide.

Claims (1):

• Demonstrating accountability includes maintaining documentation of an organisation's processing activities, a measure the ICO expects controllers to adopt as part of governance.

Joint Controller ArrangementsGreen

Where two or more parties jointly determine the purposes and means of processing the same personal data, they are joint controllers; controllers bear the highest level of compliance responsibility including for their processors.

Claims (1):

• If two or more controllers jointly determine the purposes and means of processing the same personal data, they are joint controllers; they are not joint controllers where processing the same data for different purposes.

Security MeasuresAmber

Article 32(1) technical and organisational security obligations remain enforceable, as demonstrated by the May 2026 £963,900 penalty against South Staffordshire Water following a cyber incident affecting circa 633,887 UK data subjects.

Claims (1):

• The ICO imposed a £963,900 fine on South Staffordshire Plc and South Staffordshire Water Plc for infringing Article 5(1)(f) and Article 32(1) UK GDPR following a cyber incident exfiltrating personal data of approximately 633,887 UK data subjects.

Breach NotificationGreen

The DUAA aligns the PECR personal-data-breach notification timeline with the UK GDPR standard, standardising the duty to notify the Commissioner across both regimes.

Claims (1):

• The DUAA aligns the timeline for notifying the Commissioner of a PECR security breach with the UK GDPR breach-notification timeline.

Retention And DisposalRed

No DUAA-specific retention/disposal instrument was identified in this research pass; the underlying UK GDPR storage-limitation principle (Article 5(1)(e)) continues to apply, but a dedicated primary-source citation for updated retention rules was not located in this run.

Transfer MechanismsGreen

Restricted transfers require adequacy regulations, Article 46 appropriate safeguards, or an Article 49 exception; the DUAA reworded but retained this three-tier structure under new Articles 44A-46.

Claims (2):

• Restricted transfers under UK GDPR require one of: adequacy regulations, Article 46 appropriate safeguards, or an Article 49 derogation for specific situations.
• The DUAA replaces UK GDPR Article 44 with a new Article 44A retaining the same general transfer principles while introducing new terminology of 'regulations approving the transfer' in place of 'adequacy regulations'.

Adequacy ReceivedGreen

The European Commission renewed its adequacy decisions for the UK under both GDPR and the Law Enforcement Directive on 19 December 2025, extending validity to 27 December 2031 and covering transfers from the whole EEA to the whole UK.

Claims (2):

• The European Commission adopted amended UK adequacy decisions on 19 December 2025, renewing adequacy under both the GDPR and the Law Enforcement Directive.
• Both the renewed EU GDPR and LED adequacy decisions for the UK are valid until 27 December 2031, applying to personal information transferred from the whole EEA to the whole UK.

Adequacy GrantedGreen

The UK grants full adequacy to all EEA states and partial adequacy to the US (via the UK Extension to the EU-US Data Privacy Framework), allowing UK organisations to transfer to DPF-certified US businesses without additional safeguards.

Claims (2):

• All EEA countries have full UK adequacy status, permitting UK organisations to transfer personal information to them without additional safeguards.
• The UK Extension to the EU-US Data Privacy Framework is a partial adequacy finding allowing UK (and Gibraltar) organisations to make restricted transfers to self-certified US businesses regulated by the FTC or DoT, without appropriate safeguards.

Sccs And BcrsGreen

UK organisations can use the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU SCCs, or UK Binding Corporate Rules as Article 46 appropriate safeguards.

Claims (1):

• UK organisations may use the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, or UK Binding Corporate Rules as Article 46 appropriate safeguards for restricted transfers.

Transfer Impact AssessmentGreen

Organisations relying on appropriate safeguards must complete a Transfer Risk Assessment (TRA) confirming the destination country's protection is not materially lower than under UK GDPR.

Claims (1):

• Organisations relying on appropriate safeguards for restricted transfers must complete a Transfer Risk Assessment (TRA) to confirm the standard of protection is not materially lower after transfer.

Data LocalisationRed

No general data-localisation mandate for personal data was identified for the UK regime in this research pass; UK GDPR instead relies on the adequacy/safeguards/derogation transfer model rather than in-country storage requirements. Searches covered ICO's international transfer guidance without surfacing a localisation obligation.

Financial Sector OverlayRed

The ICO and the Financial Conduct Authority (FCA) both have jurisdiction touching financial-sector personal data, but no specific FCA-ICO memorandum of understanding or overlay instrument was retrieved in this research pass; this is flagged for escalation given the disambiguation risk between DP and financial-conduct regulation.

Health Sector OverlayRed

No health-sector-specific UK data protection overlay (e.g., NHS data-sharing codes) was retrieved in this research pass; searches focused on ICO/DUAA general resources without surfacing dedicated health-sector primary sources.

Telecoms And EprivacyAmber

PECR governs cookies, unsolicited electronic marketing and traffic/location data; the ICO fined KRA Consultancy £300,000 for breaching PECR regulations 22 and 23 via 5.5 million unsolicited marketing/fake-bailiff texts, and the DUAA inserts new PECR cookie exceptions.

Claims (2):

• The ICO fined KRA Consultancy Ltd £300,000 for sending over 5.5 million unsolicited direct marketing and fake bailiff texts in breach of regulations 22 and 23 of PECR, generating over 60,000 complaints to the 7726 spam-reporting service.
• The DUAA inserts a new schedule into PECR setting out exceptions from the prohibition on storing or accessing information on a subscriber's or user's terminal equipment (the cookie rules).

Employment DataAmber

The ICO issued specific guidance and a compliance report on automated decision-making (ADM) in recruitment, following DUAA changes lifting some ADM restrictions, requiring transparency, bias testing and a right to request human review of hiring decisions.

Claims (2):

• UK GDPR Article 22A defines automated decision-making (ADM) as a decision based solely on automated processing with no meaningful human involvement that has a legal or similarly significant effect on a person.
• The ICO wrote to 16 organisations likely using ADM in hiring, securing commitments to improve transparency, bias monitoring and human-review safeguards following a March 2026 compliance report.

Credit And ScoringRed

No credit-scoring-specific UK data protection overlay was retrieved in this research pass beyond the general Article 22-equivalent ADM rules; flagged as a research gap.

EducationAmber

The ICO publishes FAQs on applying the Children's code to schools and education technology providers, but a dedicated education-sector data protection statute or code beyond the Children's code was not separately identified in this pass.

Claims (1):

• The ICO publishes dedicated FAQs applying the Children's code (Age Appropriate Design Code) to schools and education technology providers.

InsuranceRed

No insurance-sector-specific UK data protection overlay was retrieved in this research pass; flagged as a research gap requiring targeted follow-up.

Cookies And TrackersAmber

PECR prohibits storing or accessing information on a user's device absent consent or an applicable exception; the DUAA inserts a new schedule of cookie-rule exceptions into PECR.

Claims (1):

• The DUAA inserts a new schedule into PECR setting out exceptions from the prohibition on storing or accessing information on a subscriber's or user's terminal equipment (the cookie rules).

Dark PatternsAmber

The Children's code prohibits 'nudge techniques' that encourage children to weaken privacy settings or provide unnecessary personal data, functioning as a sector-specific anti-dark-pattern standard for minors.

Claims (1):

• The Children's code requires that nudge techniques not be used to encourage children to provide unnecessary personal data or weaken/turn off their privacy settings.

Opt Out SignalsRed

No UK-specific standard equivalent to Global Privacy Control or DAA opt-out signal recognition was identified in this research pass.

Clean Rooms And DcrRed

No ICO guidance on data clean rooms or data-collaboration-room arrangements was identified in this research pass.

Cross Context AdvertisingAmber

The ICO has previously found that legitimate-interest justifications offered by organisations for real-time bidding (RTB) in programmatic advertising were insufficient, indicating heightened scrutiny of cross-context ad-tech data sharing.

Claims (1):

• The ICO reviewed justifications for using legitimate interests as the lawful basis for real-time bidding (RTB) in adtech and found the justifications offered by organisations insufficient.

Direct MarketingGreen

The DUAA clarifies that direct marketing can qualify as a legitimate interest, and introduces a new charity 'soft opt-in' permitting electronic marketing to supporters without prior consent if safeguards are met.

Claims (2):

• The DUAA clarifies that direct marketing can be conducted on the basis of legitimate interests as a lawful basis under UK GDPR.
• Since 5 February 2026, charities may send electronic mail marketing (including texts and social media direct messages) furthering their charitable purposes to individuals who have expressed interest or offered support, without prior consent, under a new 'soft opt-in', subject to safeguards.

Profiling RestrictionsAmber

UK GDPR Article 22A (inserted by DUAA) defines ADM as a solely-automated decision with no meaningful human involvement having a legal or similarly significant effect, replacing the prior more restrictive Article 22 default-prohibition model.

Claims (1):

• UK GDPR Article 22A, inserted by the DUAA, defines automated decision-making (ADM) as a decision based solely on automated processing (no meaningful human involvement) that has a legal or similarly significant effect on a person.

Automated Decision Making TransparencyAmber

The ICO expects organisations using ADM to be transparent with affected individuals, explain how ADM works, and provide a route to request human review, as set out in March 2026 hiring-sector guidance and an ongoing ADM/profiling guidance consultation.

Claims (2):

• Organisations using ADM must explain to affected candidates/individuals how it works and how to exercise their right to challenge a decision and request human review.
• The ICO is developing draft ADM and profiling guidance for public consultation, which will inform a forthcoming statutory AI and ADM code of practice.

Ai Risk AssessmentsAmber

The ICO's AI and Biometrics Strategy commits to developing an AI/ADM code of practice (mandated by secondary legislation under the DUAA) and continues to audit police use of facial recognition technology.

Claims (2):

• The UK government is developing secondary legislation, committed to during passage of the DUAA 2025, requiring the ICO to produce an AI and ADM statutory code of practice.
• The ICO has conducted or is conducting facial recognition technology (FRT) audits of multiple UK police forces including South Wales, Gwent, Essex, Leicestershire, West Yorkshire and Greater Manchester Police.

Biometric RegimeGreen

Biometric recognition processing (e.g., facial recognition, fingerprint) constitutes special category biometric data under UK GDPR Article 9, generally requiring explicit consent absent another applicable condition.

Claims (1):

• Processing biometric data through a biometric recognition system meets all three elements of the UK GDPR biometric data definition, constituting special category biometric data requiring explicit consent or another valid Article 9 condition.

Genetic DataRed

No genetic-data-specific UK regulatory instrument beyond the general Article 9 special category framework was identified in this research pass.

State Surveillance CarveoutsAmber

The EDPB has raised concerns that UK national security exemptions may waive most data protection principles and limit the ICO's enforcement and inspection powers, urging the European Commission to closely monitor their application in practice.

Claims (1):

• The EDPB has flagged that UK national security exemptions may waive most data protection principles and some international transfer rules for law enforcement authorities and can limit the ICO's enforcement and inspection powers, calling for ongoing Commission monitoring.

Age VerificationAmber

Children's code Standard 3 requires establishing user age with a level of certainty appropriate to processing risk, or applying the code to all users; 2026 enforcement (Reddit, MediaLab) centred on failures to implement robust age assurance.

Claims (3):

• The Children's code applies to information society services likely to be accessed by children under 18, including UK-based and non-UK companies processing UK children's personal data, even if children are not the target audience.
• The ICO fined Reddit £14.47m for failing to apply any robust age assurance mechanism, resulting in no lawful basis for processing personal information of children under 13.
• The ICO fined MediaLab (Imgur) £247,590 for failing to implement any age assurance measures to determine the age of users between September 2021 and September 2025, exposing children to harmful content.

Parental ConsentAmber

Online services relying on consent for children under 13 must obtain consent from a parent or carer; MediaLab was fined in part for lacking parental consent measures.

Claims (1):

• UK law requires that online services using personal information of children under 13 rely on consent given by the child's parent or carer where consent is the chosen lawful basis; MediaLab was found to lack such parental consent measures for Imgur.

Minor Profiling BansGreen

Children's code Standard 10 requires profiling options to be switched off by default for children unless a compelling, best-interests-justified reason exists, with protective measures against harmful content.

Claims (1):

• Children's code Standard 10 requires profiling to be switched off by default unless the organisation can demonstrate a compelling reason accounting for the best interests of the child, with protections against harmful content effects.

Education SettingsAmber

The ICO provides FAQs applying the Children's code to schools and education technology, but no separate education-specific statutory instrument was identified.

Claims (1):

• The ICO publishes dedicated FAQs applying the Children's code (Age Appropriate Design Code) to schools and education technology providers.

Dependent AdultsRed

No dependent-adults-specific (elderly/mentally incapacitated) UK data protection instrument was identified in this research pass; flagged as a research gap.

Regulator Powers And PenaltiesGreen

The ICO can issue fines of up to £17.5 million or 4% of an organisation's annual worldwide turnover, whichever is higher, for UK GDPR/DPA 2018 breaches, and the DUAA raised PECR's maximum fine to the same ceiling while granting the ICO new powers to compel witness interviews and technical reports.

Claims (2):

• Under UK GDPR and the DPA 2018, the ICO can issue fines of up to £17.5 million or 4% of an organisation's annual worldwide turnover, whichever is higher.
• The DUAA gives the ICO new powers, including the ability to compel witnesses to attend interviews and request technical reports, and raises the PECR maximum fine to £17.5 million or 4% of global turnover.

Enforcement Activity IndexGreen

2026 enforcement actions include Reddit (£14.47m, Feb 2026), MediaLab/Imgur (£247,590, Feb 2026), South Staffordshire Water (£963,900, May 2026) and KRA Consultancy (£300,000, May 2026), reflecting a heavy focus on children's data and security/PECR marketing breaches.

Claims (4):

• On 23 February 2026, the ICO imposed a £14,472,500 penalty on Reddit, Inc. for infringing UK GDPR Articles 5(1)(a), 6, 8 and 35.
• On 26 February 2026, the ICO published a £247,590 monetary penalty notice against MediaLab for unlawful processing of children's data on the Imgur platform.
• On 7 May 2026, the ICO fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 for infringing UK GDPR Articles 5(1)(f) and 32(1) following a cyber incident.
• On 20 May 2026, the ICO fined KRA Consultancy Ltd £300,000 for breaching PECR regulations 22 and 23 through mass unsolicited marketing texts.

Regulator Funding And CapacityAmber

The ICO is transitioning from a corporation-sole structure to a chair/CEO/board governance model as part of DUAA reforms intended to provide greater institutional continuity and resilience, though the final transition timeline remained unconfirmed as of mid-2026.

Claims (2):

• The DUAA-driven governance reform moves the ICO from a corporation-sole structure to a traditional chair, CEO and board model intended to provide institutional continuity and resilience.
• As of mid-2026, the ICO's transition to the board-governed Information Commission structure has not been assigned a confirmed final transition date; the current Commissioner is expected to become Chair, with a CEO and non-executive board being appointed.

Collective Redress And Class ActionsAmber

The UK lacks a general opt-out class action mechanism for data protection claims; the Supreme Court's Lloyd v Google ruling held that a representative action under the (then) Data Protection Act failed because damages require individualised proof of material damage or distress, not mere loss of control of data.

Claims (2):

• In Lloyd v Google LLC [2021] UKSC 50, the UK Supreme Court held that damages under the (then) Data Protection Act require proof of material damage or distress caused by unlawful processing, not merely the unlawful processing (loss of control) itself, precluding the proposed representative 'class action' claim.
• Following Lloyd v Google, claimant law firms pursuing UK data-breach mass actions face the requirement that individual class members evidence the damage or distress they personally suffered, constraining opt-out-style collective redress.

Private Right Of ActionGreen

Individuals have a direct right to claim compensation from a controller in court for material or non-material damage suffered from a UK GDPR/DPA 2018 breach, though the ICO itself cannot award compensation.

Claims (1):

• UK GDPR gives individuals a right to claim compensation from an organisation in court for both material damage (e.g., financial loss) and non-material damage (e.g., distress) suffered from a breach of data protection law, though the ICO cannot itself award compensation.

Recent Developments 180DAmber

Within the last 180 days, the DUAA reached full commencement (19 June 2026) requiring all organisations to have a complaints-handling process; the ICO fined South Staffordshire Water (May 2026) and KRA Consultancy (May 2026); and the ICO published its AI and Biometrics strategy update (March 2026) alongside ADM hiring guidance.

Claims (3):

• As of 19 June 2026, all data protection provisions of the DUAA 2025 are in force, including a new mandatory requirement for all organisations to have a data protection complaints-handling process in place.
• On 7 May 2026, the ICO fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 for infringing UK GDPR Articles 5(1)(f) and 32(1) following a cyber incident.
• On 20 May 2026, the ICO fined KRA Consultancy Ltd £300,000 for breaching PECR regulations 22 and 23 through mass unsolicited marketing texts.