The Information Commissioner’s Office (ICO) has published a letter to the Prime Minister, the Chancellor of the Exchequer, and the Secretary of State for Business and Trade setting out a one-year update on its five economic growth commitments made in January 2025. These commitments are to: (1) give businesses regulatory certainty on artificial intelligence (AI); (2) cut costs for small and medium-sized enterprises (SMEs); (3) enable greater innovation through its Regulatory Sandbox and Innovation Advice services; (4) unlock privacy-preserving online advertising; and (5) make it quicker and easier to transfer data internationally. The letter confirms that the ICO is working with the government on legislation to introduce a statutory code of practice on AI and automated decision-making, and that its expanded data essentials platform for SMEs is due to launch in spring 2026. It also states that the ICO has secured funding to design an experimentation regime to support the testing of emerging technologies, with research findings due by mid-February 2026. In addition, the ICO says it is assessing low-risk online advertising activities that could operate without consent under the Privacy and Electronic Communications Regulations (PECR) and will provide evidence to the government in the spring. The letter also highlights that the ICO published updated guidance on international data transfers in January 2026, aimed at simplifying requirements and supporting cross-border data flows, which underpin around 40% of UK exports. The ICO adds that it will continue to issue further guidance and improve regulatory clarity throughout 2026.

The Information Commissioner's Office (ICO) has published new data protection fining guidance which sets out how it issues penalties and calculates fines. The guidance explains the legal framework which gives the ICO the power to impose fines, how the ICO approaches key questions like identifying the wider ‘undertaking’ or economic entity of which the controller/processor forms part and the method used to calculate fines.

The Information Commissioner’s Office (ICO) has published new guidance to help organisations securely disclose documents containing large volumes of information, particularly in response to Freedom of Information (FOI) and Subject Access Requests (SARs). The guidance addresses the risk of inadvertently disclosing hidden personal information—such as metadata, hidden rows, columns, worksheets, and active filters—and includes practical steps, checklists, and how-to videos to support organisations in identifying and removing such data. It also advises on converting documents to simpler formats, avoiding ineffective redaction techniques, and using tools such as Microsoft Document Inspector. The guidance replaces an advisory note issued in 2023 following high-profile breaches and is intended to reduce the risk of accidental disclosures across a range of document-sharing scenarios. The ICO is engaging with key stakeholders, including government bodies, to raise awareness and promote adoption of the guidance.

The Information Commissioner’s Office (ICO) has published new guidance aimed at providing regulatory certainty on how health and social care organisations should keep people informed. ICO stated that the guidance will assist organisations understand the definition of transparency and appropriately assess levels of transparency. Additionally, the guidance provides practical steps to develop effective transparency information. The guidance follows a consultation and incorporates feedback from health and social care organisations.

The Information Commissioner’s Office (ICO) has issued an open letter to social media and video-sharing platforms operating in the UK, calling for strengthened age assurance measures to enhance their age assurance measures beyond mere self-declaration by children. The ICO addressed its letter to TikTok, Snapchat, Facebook, Instagram, YouTube and X requesting that they demonstrate compliance with stronger age verification requirements.

The Information Commissioner’s Office (ICO) has published a progress update on its Children's Code Strategy and has called for stakeholders to share their views on aspects of this Strategy. The ICO has also called on 11 social media and video-sharing platforms to improve their children’s privacy practices following ongoing review of social media platforms (SMPs) and video sharing platforms (VSPs) as part of its Strategy. The ICO questions the 11 platforms on issues involving default privacy settings, geolocation or age assurance, and to explain how their approach conforms with the Children's Code, following concerns raised by the review. The ICO reiterates these points in its progress update. As for the call for evidence, it focuses on two specific areas of children's privacy: how children’s personal information is currently being used in recommender systems, and recent developments in the use of age assurance to identify children under 13 years old. The evidence gathered will be used to inform the ICO's ongoing work to secure further improvements in how SMPs and VSPs protect children’s privacy. The call for evidence closes on 11 October 2024.

The Information Commissioner's Office (ICO), together with Nesta's Centre for Collective Intelligence (CCI), has published a report setting out the findings of a Citizens' Jury on public views of neurotechnology and neurodata. The Citizens' Jury, commissioned by the ICO and funded by the Department for Science, Innovation and Technology (DSIT) and the Regulatory Innovation Office through the fourth round of the Regulators' Pioneer Fund, explored public attitudes towards the use of neurotechnology as it expands beyond healthcare into areas such as wellbeing, workplace safety and consumer products. The report is intended to support the ICO's development of guidance on the application of data protection law to neurotechnologies and neurodata.

The Information Commissioner’s Office (ICO) has published its outcomes report on data protection in generative AI, following a consultation launched in January 2024 that received over 200 responses. The ICO refined its position on the lawful basis for web scraped data and engineering individual rights into AI models.

The Information Commissioner’s Office (ICO) has published its 'Edtech examined' report following audits conducted in 2024–25 of 28 edtech providers used in UK primary and secondary schools. The report found positive practices in information security but also identified several compliance gaps, including providers failing to correctly determine whether they were acting as data processors or controllers, contracts with schools lacking sufficient detail, incomplete data flow mapping, limited application of the data minimisation and storage limitation principles, outdated privacy information and gaps in Data Protection Impact Assessments. The ICO states that children’s personal information must be processed responsibly and fairly in line with data protection law and notes that 98% of its 596 recommendations have been accepted, with further work underway with the Department for Education to improve the handling of children’s data and explore the development of a new edtech code.

The Information Commissioner’s Office (ICO) has published a response to the Home Office’s draft regulations designed to provide clearer safeguards around how vulnerable people within the immigration system are able to access the information held about them. The draft regulations were published by the Home Office following a Court of Appeal ruling in December 2023 that an exemption in the Data Protection Act 2018 was not clear enough and did not contain sufficient built-in safeguards to prevent abuse and protect people’s rights. According to the ICO, the draft regulations have satisfied all the requirements laid down in the judgment.

The Information Commissioner’s Office (ICO) has published its response to the government request for a plan for enabling safe artificial intelligence (AI)-powered innovation. The response sets out the progress made under the ICO’s June 2025 AI and biometrics strategy, including work to provide regulatory certainty and improve standards in AI, automated decision-making and biometric technologies across the public and private sectors.

Information Law analysis: Lorna Cropper, Director of the Technology and Data Team at Fieldfisher LLP, considers the background to the updated ICO Opinion on age assurance for the Children’s Code (Opinion) and what the key differences between it and the original opinion are. Cropper also considers how the age assurance guidance set out in the Opinion interrelates with age assurance requirements under the Online Safety Act 2023 (OSA 2023); what sort of age assurance methods are recommended in this Opinion; what other practical considerations the Opinion raises and what the ICO says about artificial intelligence (AI) and age assurance methods.