The Data (Use and Access) Act 2025 introduced several important regulatory changes to the existing UK data protection framework. One of the most notable changes is the introduction of a formal right for individuals to complain directly to organisations about how their personal data has been handled. This has consequently necessitated organisations to have in […]
United Kingdom
Understanding the ICO’s Encryption Guidance under UK GDPR
The United Kingdom’s Information Commissioner’s Office (ICO) has released detailed guidance on the use of encryption under the UK GDPR. This guidance is a part of the ICO’s wider information-security programme and is designed to help organisations use encryption effectively to safeguard personal information. This article outlines the key points of the ICO’s guidance on […]
UK Data (Use and Access) Act 2025: Key Changes for Privacy Compliance
On 19 June 2025, the Data (Use and Access) Act 2025 (DUAA) received Royal Assent, becoming law in the UK and marking a significant development in the country’s data protection framework. The first provisions will take effect on 20 August 2025 under the Commencement No. 1 Regulations, with others phased in through mid‑2026; some changes (most […]
Another sword in the battleground against the UK’s hope to seek adequacy decision
Court of Appeal of the United Kingdom holds the ‘immigration exemption’ under the Data Protection Act 2018 as unlawful On May 26, 2021, the Court of Appeal of the United Kingdom handed down its judgment in the case of R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ […]