Data Protection 

Share

Latest news on data protection, covering UK GDPR, GDPR, the Data Protection Act 2018, the Information Commissioner's Office (ICO), the Data (Use and Access) Act 2025, data breaches, ICO fines, personal data, data subject access requests (DSARs), data protection officers (DPOs), PECR, cookies, consent, adequacy decisions, international data transfers and surveillance laws.

Data protection law governs how organisations collect, store and use personal information, and it gives people rights over their data. In the UK it rests on the UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office. Individuals have rights of access, erasure and portability, and organisations must keep data secure and report certain breaches.

The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). It also replaces the single Information Commissioner with a board-led Information Commission. On 19 December 2025 the European Commission renewed its adequacy decisions for the UK until 27 December 2031, so personal data can keep flowing from the EU.

Organisations manage compliance with data protection officers, privacy notices, impact assessments, consent records and breach response plans. People can make a data subject access request to see what an organisation holds about them, and they can complain to the ICO. Cookie banners and marketing consent choices are an everyday part of the PECR rules.

Debate continues over how to balance innovation with protection. Businesses say compliance can be costly and complex, while campaigners say enforcement is too light and that reforms risk weakening rights. Surveillance laws and their effect on civil liberties remain a long-running theme alongside the growing value of personal data.

The UK's Data Protection Act 1998 put the 1995 EU directive into law, and the GDPR replaced that directive when it applied from 25 May 2018. The Data Protection Act 2018 received Royal Assent on 23 May 2018, and after the UK left the EU the regulation became the UK GDPR. British Airways was fined 20 million pounds over a 2018 cyber attack that exposed the details of more than 400,000 customers.

Rules and enforcement keep changing, so staying informed helps people and organisations protect data. Our NewsNow data protection news feed brings together the latest headlines on data protection, UK GDPR, ICO action, data breaches and privacy law from reliable UK sources, so you have a comprehensive, up-to-date view.