United Kingdom: Data Protection

From 19 June 2026, all organisations that act as data controllers must have a formal process in place for individuals to raise data protection complaints directly with them

The regulatory landscape for age assurance is changing more rapidly than ever, with legislators and regulators globally intensifying efforts to protect children online.

Internal investigations increasingly rely on AI tools to process large volumes of personal data, but this efficiency comes with significant data protection risks under UK GDPR.

As EU-based businesses will be aware, the European Commission unveiled a digital simplification package in November 2025 proposing significant changes to the EU AI Act, the GDPR, e-privacy and cyber incident reporting rules. The aim is to simplify and soften rules that are perceived to hinder the EU's digital competitiveness and act as a brake on innovation.

On 1 December 2025, the Information Commissioner's Office (ICO) announced a monitoring programme that targets 10 popular mobile games played by children in the UK.

From 19 June 2026, all pension scheme trustees will be required, as data controllers, to have a process in place for the handling of data protection related complaints.

In a two-pronged approach covering online safety and data protection laws, both Ofcom and the ICO have written to major tech platforms to ask them to enforce their minimum age rules with highly effective age checks.

UK financial regulators are signaling a fundamental shift in cyber-security oversight as 2026 marks the convergence of new operational incident reporting requirements, critical third-party provider designations, and the Network and Information Systems Bill. With cyber attacks increasing in frequency and over 40% involving third-party providers, firms face heightened expectations to demonstrate not just documented controls, but credible...

In November 2025, the European Commission introduced a digital omnibus package with the aim of simplifying cybersecurity compliance processes for European companies.