The Information Commissioner’s Office (ICO) has issued a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing personal data via advertising cookies without users’ consent, which breached Article 5(1)(a), Article 6(1)(a) and Article 7(1) of the United Kingdom’s General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). Between 10 January and 3 March 2023, the company shared data with advertising technology firms before users had the chance to accept or reject cookies. Following an investigation, Sky Betting and Gaming implemented changes in March 2023 to ensure users could reject cookies before any data sharing took place. This action forms part of the ICO’s broader efforts to enforce compliance with data protection law in online advertising.

The Information Commissioner's Office (ICO) has taken regulatory action against four public authorities for persistent failures to meet their obligations under the Freedom of Information Act (FOIA). City of London Police has been served with an enforcement notice, requiring them to devise and publish an action plan within 30 days to address their low compliance rate of 68% and clear their backlog within six months. Staffordshire Police, Dorset Police and Goldsmiths, University of London have been issued practice recommendations to improve their information rights practices. These actions aim to address significant backlogs, timeliness issues and poor compliance performance in responding to FOI requests, emphasising the ICO's commitment to upholding the public's right to prompt access to information.

The Information Commissioner's Office (ICO) has updated its main Subject Access Request (SAR) guidance following the Data (Use and Access) Act, 2025 and published a new subject access request template for small businesses. The template, titled 'Ask for copies of your data,' is designed to help small businesses understand and organise requests from individuals seeking copies of their personal data. The ICO states that while individuals have the right to request copies of their personal data, they are not required to use the provided template. The template includes sections for requestor contact details, preferred response method, specific data being requested, relevant date ranges, and additional information to assist with data searches. The ICO has indicated that its bitesize guides on this topic are under review and may be subject to change following the Act. Businesses must typically respond to subject access requests within one calendar month, though extensions and reasonable administrative fees may apply in certain circumstances.

The Information Commissioner's Office (ICO) has updated its UK General Data Protection Regulation (GDPR) lawful basis guidance to reflect the amendments introduced by the Data (Use and Access) Act (DUAA 2025). The updated guidance introduces a seventh lawful basis termed 'recognised legitimate interest.' This new basis covers pre-approved purposes, including safeguarding vulnerable people, responding to emergencies, preventing or investigating crime, addressing national security matters and sharing personal information for public tasks. However, it does not apply to public authorities processing personal information for their official tasks.

The Information Commissioner’s Office (ICO) has published its updated guidance on data protection by design and by default alongside the commencement of key Data (Use and Access) Act 2025 (DUAA 2025) provisions. The guidance clarifies that organisations must build data protection considerations into the design and operation of systems, services, products, and processes, ensuring that only the minimum necessary personal information is collected, used, stored, and accessed for each defined purpose. It explains the need for appropriate technical and organisational measures, including robust security controls, clear retention practices, strong default privacy settings, and regular assessment of risks through data protection impact assessments.

The Information Commissioner’s Office (ICO) has updated three guidances:

The Information Commissioner’s Office (ICO) has updated its guidance on direct marketing using electronic mail to reflect the ‘charitable purposes soft opt-in’ provision introduced by the Data (Use and Access) Act 2025, which came into force on 5 February 2026, explaining how charities may send emails, text messages and social media messages to individuals who have expressed an interest in or supported their charitable purposes without prior consent, provided specified conditions and safeguards are met. The guidance clarifies the application of the provision, including in relation to direct collections and the role of third parties, and aims to support compliant use while protecting individuals’ rights. The Fundraising Regulator welcomed the update and confirmed continued collaboration with the ICO, alongside plans to issue complementary resources, and organisations were also reminded of the requirement to implement processes for handling data protection complaints by 19 June 2026.

The Information Commissioner’s Office (ICO) has updated its guidance on the public interest test under the Freedom of Information Act 2000 (FIA 2000), following the Supreme Court’s decision in Department for Business and Trade v Information Commissioner [2025] UKSC 27. The judgment confirmed that where the same information engages multiple qualified exemptions, public authorities may consider cumulatively the public interest factors supporting those exemptions when balancing them against the public interest in disclosure. The guidance explains how public authorities should apply the test in these circumstances and clarifies the information they should provide in refusal notices where they decide to withhold information. It also sets out the ICO’s expectations where an applicant complains about such a decision. The ICO has also published a separate summary guide providing a concise overview of the key principles for applying the FIA 2000 public interest test.

The Information Commissioner's Office (ICO) has updated its interpretation of what counts as inferred special category data. The guidance no longer focuses on the certainty of an inference as a relevant factor to decide whether it counts as special category data, with this change aiming to provide clarity.

The Information Commissioner’s Office (ICO) has updated its guidance on completing transfer risk assessments (TRAs) for international transfers of personal data under the UK General Data Protection Regulation (UK GDPR). The updated guidance reflects changes introduced by the Data (Use and Access) Act 2025, including a change in terminology under which transfer risk assessments are now referred to as ‘data protection tests’ in UK legislation.

The Information Commissioner’s Office (ICO) has published its updated Opinion on age assurance for the Children’s code, which reflects developments over the past two years. The updated Opinion provides guidance on what online services must do if they are likely to be accessed by children, highlights the technological developments in this area and explains legislative developments and how organisations can meet their data protection obligations while also complying with the Online Safety Act 2023 (OSA 2023). The Opinion further describes how age assurance can be part of a necessary and proportionate approach to minimising or removing risks and conforming to the code. It also lays out how the Information Commissioner expects online services to apply age assurance measures that are suitable for their use of children’s data.

The Information Commissioner’s Office (ICO) has provided an update on its action to improve cookie compliance, reporting that over 95% of the UK’s top 1,000 websites now meet its compliance checks, giving around 40 million users greater control over personalised advertising. Its assessment considered whether non-essential advertising cookies were set before users could choose, whether rejecting cookies was as easy as accepting them and whether any were placed without consent. The ICO confirms that 564 websites improved their practices following engagement and preliminary enforcement notices, while action continues in relation to 21 remaining non-compliant websites, with further updates expected in 2026.