This Flowchart illustrates how to manage a data protection breach (including a cybersecurity breach) under the UK General Data Protection Regulation (UK GDPR). It reflects personal data breach reporting and recording requirements under the UK GDPR together with data breach management guidance issued by the Information Commissioner's Office (ICO). It maps out a data breach process, providing guidance and links to relevant precedents for each stage of that process. See Precedents: Personal data breach plan, Data breach report form—internal and Data breach assessment and action plan, which guide you through each stage of this workflow. Note 1—assemble data breach team The first step is to assemble your data breach team. Consider who within the organisation would be best placed to react swiftly to the breach and who should be involved with the subsequent investigation. This will often involve input from specialists across the business such as IT, HR and compliance/legal and, in some cases, contact with external stakeholders and suppliers. Precedent: Personal data breach plan encourages you to assemble a skeleton data breach team in advance

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. These highlights focus on key topics including data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation

EU Law analysis: Kristof de Vulder, Alessandro Ferrari and Linzi Penman, partners, and Conor McEneaney, legal director, at DLA Piper, discuss the scope and impact of the upcoming Digital Operational Resilience Act (DORA). They offer practical guidance to organisations dealing with one of the most comprehensive gap analysis and remediation exercises to face the EU financial services sector in recent years.

The Commission has introduced an information and communication technologies (ICT) Supply Chain Security Toolbox, developed with Member States and EU Agency for Cybersecurity (ENISA) through the NIS2 Cooperation Group, to create a common EU approach to identifying and mitigating cybersecurity risks in ICT supply chains. The toolbox will help Member States and public and private actors to bolster the security of ICT supply chains in the EU as set out in the proposed Revised Cybersecurity Act presented on 20 January 2026. It also proposed a trusted ICT supply chain framework under the revised EU Cybersecurity Act and published two risk assessments on connected vehicles and border detection equipment.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. These highlights focus on key topics including data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. These highlights focus on key topics including data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Information Law analysis: This News Analysis provides a round-up of key developments in the field of Information Law in England & Wales and at supranational EU level in 2025 and looks ahead to what’s coming up in 2026. This edition focusses on confidential information, data protection and eprivacy, cybersecurity, reputation management, public sector information and state security and intelligence.

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

ARCHIVED: This Practice Note has been archived and is not maintained. 11 pm (GMT) on 31 December 2020 marked the end of the implementation period put in place to enable the UK to transition away from the EU’s laws and institutions. At this point in time (referred to in this document as ‘IP completion day’) there was an immediate and significant change in the UK’s legal regime. This Practice Note explains the implications of this change in relation to the following areas of Information Law and practice: • Overview—what happened on 31 December 2020 • Access to EEA workers • Commercial arrangements • Data protection (except as relevant to law enforcement processing and intelligence services processing) • ePrivacy • Cybersecurity • Databases • Public sector information • Confidential information • Reputation management For a tracker of key Information Law Brexit legislation and guidance, see Practice Note: Information Law—Brexit tracker. This Practice Note focuses on the topics above, except that it does not cover the impact on law enforcement processing or state security

Status of EU directives following Brexit Retained EU law (‘REUL’) is a legal concept describing EU-derived rights and legislation preserved by the UK following Brexit. It is a defined term under the European Union (Withdrawal) Act 2018 (EU(W)A 2018), and the collective term given to the body of EU-derived laws the UK preserved and converted into domestic UK law, effective on the repeal of the European Communities Act 1972. Assimilated law is the name given to REUL which remains in force from 1 January 2024 pursuant to the Retained EU Law (Revocation and Reform) Act 2023. The re-categorisation of REUL (and associated terms) to assimilated law reflects a change in its status and treatment under UK law, in that it is generally to be interpreted according to ordinary domestic law and principles. From 1 January 2024, REUL is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously