Data protection regime

FORTHCOMING CHANGE: On 19 June 2025, the Data (Use and Access) Bill received Royal Assent, becoming the Data (Use and Access) Act 2025 (DUAA 2025) and coming partly into force on that date. Parts 5 and 6 serve to amend aspects of data protection and ePrivacy law in the UK, including the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426. Certain provisions of DUAA 2025, concerning matters such as responding to data subject access requests and the conferring of power to make further regulations, came into force immediately on 19 June 2025. Other provisions, concerning notices from the Information Commissioner and some aspects of law enforcement processing, come into effect on 19 August 2025 (being two months from the date of Royal Assent). The majority of DUAA 2025’s provisions require further regulations (in the form of statutory instruments) to be made to bring them into force. For further information on DUAA 2025 generally, see Practice Note: The Data (Use and Access) Act

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Commission proposes cybersecurity package including revisions to Cybersecurity Act

The European Commission has proposed a new cybersecurity package aimed at addressing increasingly sophisticated cyber and hybrid threats facing the EU. According to the Commission, essential services and democratic institutions across the bloc continue to experience cyber incidents linked to both state and criminal actors.

ICO fines two companies £225,000 for nuisance marketing messages

The Information Commissioner’s Office (ICO) has fined Allay Claims Ltd and ZMLUK Limited a total of £225,000 for sending millions of unsolicited marketing messages in breach of Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2426 (PECR). Allay Claims Ltd was fined £120,000 for sending more than four million unlawful marketing text messages promoting payment protection insurance (PPI) tax refund services without valid consent and could not rely on the ‘soft opt-in’ exemption due to failures at the point of data collection. ZMLUK Limited was fined £105,000 for sending over 67 million marketing emails using third-party data where individuals were not given clear and informed choices, meaning the consent relied on was invalid.

Regulation (EU) 2025/2518 and what it means for reforming cross-border EU GDPR enforcement procedures

EU Law analysis: Regulation (EU) 2025/2518 (the Procedural Regulation) lays down EU-wide procedural rules for the enforcement of the EU General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) in cases involving cross-border processing of personal data. It aims to address inefficiencies and inconsistencies currently observed in cross-border enforcement under the EU GDPR. Key features include harmonised rules for admissibility of complaints and cooperation between Supervisory Authorities, streamlined ‘early resolution’ and ‘simplified cooperation’ procedures, and rights for parties under investigation to have their views heard. Paul Greaves is dual-qualified in England and Wales and Belgium, and is a counsel in Alston & Bird’s Privacy, Cyber & Data Strategy team.

EDPB publishes contribution to Commission's evaluation of Law Enforcement Data Protection Directive

The European Data Protection Board (EDPB) has published its contribution to the European Commission's evaluation of Directive (EU) 2016/680 (the Law Enforcement Data Protection Directive (LED)). The report identifies enforcement challenges, particularly in distinguishing the scope of the LED from Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR)). The EDPB also highlights the increasing use of artificial intelligence (AI), biometric technologies and facial recognition in law enforcement, warning that such tools pose heightened risks to fundamental rights where they are not subject to strict necessity, proportionality and appropriate safeguards under the LED. In addition, the report points to gaps in national transposition, the limited use of international data transfer mechanisms and growing calls from supervisory authorities for further EDPB guidance on high-risk law enforcement processing and operational data protection impact assessments (DPIAs).

View Information Law by content type :

News