The Information Commissioner’s Office (ICO) has launched a consultation on the accuracy of generative artificial intelligence (AI) models as part of its third instalment in its consultation series, which examines how data protection law applies to the development and use of generative AI. This third consultation focuses on how data protection’s accuracy principle applies to the outputs of generative AI models, and the effect that accurate training data has on the output, to avoid misinformation, reputational damage and other harms. The consultation is open until 5pm on 10 May 2024.

The Information Commissioner's Office (ICO) has launched a consultation proposing changes to its data protection complaint handling processes. The consultation introduces a new assessment framework for determining which complaints warrant investigation. The changes respond to rising complaint volumes, which reached 42,881 in 2024/25, and align with new Data (Use and Access) Act requirements for organisations to maintain internal data protection complaint procedures. The framework aims to enable the ICO to focus resources on higher-risk cases while maintaining oversight of systemic issues. The consultation closes on 31 October 2025.

The Information Commissioner’s Office (ICO) has launched a 12-week consultation on draft enforcement procedural guidance, which aims to increase transparency arouns the ICO's investigation and enforcement processes under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, including new powers under the Data (Use and Access) Act 2025 to require answers to questions and organisational reports. The guidance specifically explains when and how the ICO opens investigations, uses its information gathering powers, how enforcement decisions are made and how settlement with reduced fines may be appropriate. The consultation closes on 23 January 2026.

The Information Commissioner's Office (ICO) has launched a consultation seeking feedback on new draft guidance for organisations handling data protection complaints. The guidance explains requirements introduced by the Data (Use and Access) Act, which amends the Data Protection Act 2018 through section 164A. The amendments require organisations to implement complaint mechanisms, acknowledge complaints within 30 days, respond appropriately without undue delay and inform complainants of outcomes. The consultation closes on 19 October 2025 and aims to clarify compliance requirements before final publication.

The Information Commissioner’s Office (ICO) has launched a public consultation on draft guidance covering the recognised legitimate interest basis for requesting personal information in support of public tasks or official functions. This guidance is intended solely for public authorities and similar bodies that request voluntary data sharing from other organisations to fulfil their public responsibilities. It forms part of the recognised legitimate interest framework introduced by the Data (Use and Access) Act 2025 and is distinct from the broader guidance on recognised legitimate interest, which is also under consultation. The consultation runs until 30 October 2025.

The Information Commissioner’s Office (ICO) launched a consultation seeking stakeholder views on a revised regulatory approach to online advertising under the Privacy and Electronic Communications Regulations (PECR). The ICO proposes a risk-based model to support privacy-friendly, commercially viable advertising solutions that reduce reliance on consent. Responses are due by 29 August 2025.

The Information Commissioner’s Office (ICO) launched a consultation on a new chapter of its updated guidance on storage and access technologies, following the introduction of the Data (Use and Access) Act 2025. The guidance, which covers cookies, tracking pixels and related tools, clarifies consent requirements under PECR and the UK GDPR. The consultation runs until 26 September 2025 and seeks feedback to ensure the final guidance supports compliance.

The ICO has introduced a free online tool called the direct marketing advice generator to assist organisations in ensuring their direct marketing activities comply with the Privacy and Electronic Communication Regulations SI 2003/2426 and Assimilated Regulation (EU) 2016/679 (UK General Data Protection Regulation). This tool, primarily designed for small organisations, provides tailored compliance advice covering various marketing channels including email, SMS, direct mail, social media, and telemarketing. The tool aims to simplify data protection compliance, enabling organisations to efficiently access relevant guidance and avoid potential complaints and financial penalties.

The Information Commissioner's Office (ICO) has launched Data Protection Essentials, a free online training programme designed to give small and medium sized organisations, their employees and sole traders clarity on data protection and practical advice on how to apply the essentials confidently in their everyday work. The training includes sector-specific examples for the education and childcare, health and social care, professional services, retail and property sectors, and covers activities such as sharing information, managing records securely, supporting marketing and customer engagement activities, and reducing the risk of data breaches. The programme aims to help organisations manage and protect people's information, use personal information confidently while reducing risk, better understand their legal responsibilities, and demonstrate a commitment to protecting personal information and maintaining trust. Participants who complete the training receive a digital certificate, while organisations can complete a self-assessment to earn a certificate and optional entry onto a public register.

The Information Commissioner's Office (ICO) has announced investigations into how TikTok, Reddit, and Imgur use the personal information of UK children. The investigation into TikTok focuses on how the platform uses the personal data of children aged 13–17 to make recommendations and deliver content, amid concerns about children being exposed to inappropriate or harmful content. The investigations into Reddit and Imgur examine their age assurance measures and use of children's personal information. These investigations are part of broader efforts to ensure social media platforms protect children's privacy and comply with data protection laws. The ICO has also published a progress update on its Children’s code strategy, outlining its key interventions in this space, and including a comparison table of some of the privacy practices of 29 social media and video sharing platforms.

The Information Commissioner's Office (ICO) has launched a new audit framework to assist organisations in assessing compliance with data protection laws. This framework features nine toolkits covering areas such as accountability, cybersecurity, and personal data breach management, empowering organisations to identify areas for improvement. By using the framework, organisations can enhance their data protection practices and foster a culture of compliance, ultimately building trust with the public.

The Information Commissioner’s Office (ICO) has launched a strategy to intensify regulatory oversight of AI and biometric technologies, focusing on ensuring responsible use of personal data. The strategy will scrutinise the use of automated decision-making systems in recruitment, facial recognition technology by police, and the use of personal data in training generative AI models. It also includes developing a statutory code of practice for responsible AI and examining emerging risks such as agentic AI. The ICO aims to support innovation while reinforcing public trust, and plans to consult on updated guidance and produce a horizon scanning report over the coming year.