Data breaches, sanctions and enforcement

This subtopic discusses managing a data security breach involving personal data as well as sanctions and enforcement actions by the Information Commissioner’s Office (ICO) under the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). This Overview provides a high-level introduction to the subtopic and signposts more detailed guidance housed within it.

Assimilated law is the name given to retained EU law (REUL) which remains in force after the end of 2023, such as the UK GDPR. The re-categorisation of REUL (and associated terms) to assimilated law reflects a change in its status and treatment under UK law, in that it is generally to be interpreted according to ordinary domestic law and principles. From 1 January 2024, REUL is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously retained under the European Union (Withdrawal) Act 2018). For more information, see Practice Note: Assimilated law and News Analysis: Implications of the move to ‘assimilated’ law, and the Retained EU Law (Revocation and Reform)