United Kingdom: Data Protection

On July 16 2025, the ICO published its annual report and financial statements for the period from April 1 2024 to March 31 2025 (the Report).

Carter-Ruck advises clients in relation to all of these questions, and on their important rights under the Data Protection regime.

On 8 August, the UK Department for Science, Innovation & Technology ("DSIT") published a report titled "Emerging technologies and their effect on cyber security" (the "Report").

Responsible AI adoption begins with understanding the UK's regulatory approach. Unlike the European Union, which has implemented the AI Act, the UK has favoured a sector-specific and principles-based approach to AI regulation aimed at supporting innovation while managing risks.

The Information Commissioner's Office (ICO) has launched a public consultation on its draft guidance for consumer Internet of Things (IoT) products and services, alongside a draft impact assessment.

On 22 July 2025, the European Commission announced that it had launched the process to renew the adequacy decision for the United Kingdom (UK) and confirmed that the UK's updated data protection framework...

The Pension Schemes Bill has been laid before Parliament. Its provisions include...

The UK's Data (Use and Access) Act 2025 (the Act) officially came into law on June 19.

On 17 June 2025, the ICO announced that it issued a monetary penalty of £2.31 million against genetics and research company 23andMe, following a joint investigation with the Office of the Privacy Commissioner of Canada...