MLex: UK companies are still awaiting the Cyber Security and Resilience Bill, as lawmakers this week renewed pressure on the government to introduce the legislation as soon as possible. The Bill is expected to align with Directive (EU) 2022/2555 (NIS 2 Directive) and to expand regulatory duties across critical sectors. But following a cabinet reshuffle, the government refused to give a timeline when questioned on 10 September 2025, saying only that it would be introduced ‘when parliamentary time allows’.

Welcome to this week’s edition of the Information Law weekly highlights a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

This week’s edition of Information Law weekly highlights includes a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

This week’s edition of Information Law weekly highlights includes a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. These highlights focus on key topics including data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

This Practice Note provides a summary of the key Risk & Compliance developments which have impacted compliance professionals in the private sector in England and Wales in 2026, including legislation, consultations, and other notable developments. For information on ongoing and expected developments, see Practice Note: Risk & Compliance horizon scanner—2026. Data protection, AI and cybersecurity What’s happened? When? What’s the impact? Find out more ICO updated brief guidance on subject access The Information Commissioner’s Office (ICO) has updated its guidance on subject access to reflect changes under the Data (Use and Access) Act 2025 (DUAA 2025), and to bring this brief guidance in line with the updated detailed Right of access guidance. 16 July 2026 DUAA 2025 states when firms are dealing with a data subject access request (DSAR), they are only required to carry out a reasonable and proportionate search. It also allows the time limit to be extended by two months in certain circumstances and provides a mechanism to clarify the information relating to a DSAR. ICO, UK guidance and resources,

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

As explained in Practice Note: The Network and Information Systems Regulations 2018, in particular section: Incident reporting obligations, the incident reporting thresholds for relevant digital service providers (RDSPs) under the Network and Information Systems Regulations 2018 (NIS Regulations), SI 2018/506, are prescribed by the NIS Regulations, SI 2018/506, reg 12(7) and Articles 3 and 4 of Retained Regulation (EU) 2018/151 (the Retained DSP Regulation). An RDSP must notify the ICO about any incident (as defined in the NIS Regulations) which has a ‘substantial impact’ on the provision of any of the following digital services it provides: • online marketplaces • online search engines • cloud computing services In summary, in order for an RDSP to determine whether the impact of an incident is substantial, an RDSP must: • take into account the following parameters

This week’s edition of Information Law weekly highlights includes a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

This week's edition of Practice Compliance weekly highlights includes: the latest sanctions news, the publication of final guidance on keeping employment records by the ICO as well as its response to the generative AI consultation series, the publication of the Code of Practice for the cybersecurity of AI by the UK government and the adoption of a 2025 Work Programme by the European Commission.