ARCHIVED: This Practice Note is archived. It is not maintained and is for background information only. This year’s annual round-up reviews some of the most significant developments of 2017 and previews what is on the horizon for 2018. This includes the implementation of the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), the UK’s proposed Data Protection Bill, the results of the first annual review of the EU-US Privacy Shield, the implementation of the Network and Information Security Directive, Directive (EU) 2016/1148 (NIS Directive) and the progress of the draft ePrivacy Regulation. Also included are updates on Lexis®+ UK’s content, including news of exciting developments from the past year and what is coming up in the next 12 months. Reviewing 2017 Data protection What happened? With the deadline for compliance with the GDPR on the horizon for 25 May 2018 (see Data protection below), the Information Commissioner’s Office (ICO) has been encouraging organisations to consider what steps will be required for them to meet their obligations under the

This week's edition of Practice Compliance weekly highlights includes: updated guidance on reporting suspected trade sanctions breaches by the DBT and OTSI, new restrictions on ransomware that may redirect cybercriminal activities to the private sphere, updated recommendations for managing external delays in legal processes, and emerging prospects for the UK to impact how corporate misdeeds are regulated.

STOP PRESS: On 14 July 2026, the government issued the Revised Telecommunications Security Code of Practice (version 1.1) under sections 105E and 105F of the Communications Act 2003. This Practice Note is in the process of being updated to reflect the revised code of practice. See: LNB News 14/07/2026 45. This Practice Note sets out practical guidance on the security obligations relevant to communications providers in the UK. This includes guidance on: the Telecommunications (Security) Act 2021 (T(S)A 2021); secondary legislation including the Electronic Communications (Security Measures) Regulations 2022 (Security Regulations), SI 2022/933; and, the Telecommunications Security Code of Practice. Guidance on Ofcom’s role in enforcing the security obligations is also included. For more information generally on the UK’s regulatory landscape, see Practice Note: The UK regulatory framework for telecommunications. Background and legislative framework T(S)A 2021 provides the mechanism for the telecoms security framework in the UK. Under T(S)A 2021, the government has powers to make regulations placing specific security obligations on the providers of public electronic communications networks

MedTech Europe has published a position paper welcoming the European Commission’s proposal for a European Competitiveness Fund (ECF). It states that the ECF represents a key opportunity for the medical technology and digital health sectors to bridge the gap between research and large-scale deployment, maintain Europe’s leadership in health innovation, and support sustainable and resilient healthcare systems. However, MedTech Europe stresses that the ECF must include clear, predictable, and operational mechanisms to safeguard long-term investment in health research, development, and innovation; ensure the effective deployment and scale-up of health innovations; reinforce health data, cybersecurity, and sustainability infrastructures; and embed health-resilience objectives in national and regional investment planning.

The Body of European Regulators for Electronic Communications (BEREC) has published a number of new reports which focus on topics including Member States’ best practices to support adequate broadband internet access services, 2G/3G phaseout practices and challenges and current cybersecurity challenges and dependencies in electronic communication networks (ECNs). BEREC has also published a number of draft reports including a draft report on the entry of large content and application providers into the markets for ECNs and services and a draft report on Cloud and Edge computing services.

MLex: The European Commission has set a provisional date of 10 December 2025 for the publication a digital package, including a so-called omnibus that will propose amendments to legislation, potentially addressing landmark laws such as the EU AI Act and Regulation (EU) 2016/679 (EU General Data Protection Regulation), according to an internal document seen by MLex. The package also includes the review of the Cybersecurity Act, and legislative developments in the Digital Networks Act and European Business Wallet, while the proposal for a Cloud and AI Development Act is scheduled for release on 16 December 2025.

The European Commission launched its 'Virtual Worlds Toolbox' on 31 March 2025, providing guidance on navigating virtual environments and outlining EU citizens' rights in digital spaces. The toolbox, part of the 2023 EU Strategy on Web 4.0 and Virtual Worlds, implements 23 recommendations from the European Citizens' Panel structured around eight principles including freedom of choice, safety, and transparency. The resource covers working, learning, and gaming in virtual spaces, with specific focus on cybersecurity and protection against disinformation. Its launch coincides with the Global Multistakeholder High-Level Conference on Web 4.0 Governance, co-organised with the Polish Presidency.

His Majesty, King Charles III, has set out the government’s priorities and proposed policies at the first State Opening of Parliament under the newly elected government, which took place on 17 July 2024. Key themes for Information Law include the Cyber Security and Resilience Bill and the Digital Information and Smart Data Bill. Rhiannon Webster, partner and head of UK data privacy and cybersecurity at Ashurst, Jason Raeburn, partner at Paul Hastings, and Edward Machin, counsel at Ropes & Gray, comment on the King’s Speech 2024.

The Body of European regulators for Electronic Communications (BEREC) has adopted its high-level position on Artificial Intelligence(AI) and virtual worlds which it has submitted to the European Commission. BEREC notes that some key issues concerning their competition dynamics, internet openness, environmental footprint and sustainability, and cybersecurity needs to be assessed and tackled in order to unleash the potential of AI and virtual worlds, and to make sure that these technologies develop for the benefit of European citizens. These key issues include among others a human-centric approach, and security as well as BEREC’s contribution to the regulation of digital markets.

This week's edition of Practice Compliance weekly highlights includes our new compliance forecast, OFSI’s annual frozen assets reporting notice for 2025, renewed pressure on the UK government to introduce cyber regulation reform, clarification from the ICO on myths surrounding storage and access technologies and the House of Commons’ rejection of House of Lords amendments to the Employment Rights Bill.

When arbitrating disputes seated in the United States of America (USA or US), domestic disputants can choose from a number of arbitral institutions to administer the proceedings. This Practice Note is intended to familiarise practitioners with the most commonly used arbitral institutions in the US: the American Arbitration Association (AAA); the International Institute for Conflict Prevention and Resolution (CPR); and JAMS. This Practice Note outlines the key differences between the institutions in terms of panel (tribunal) selection, applicable rules, and arbitration fees, as well as other important features. In this Practice Note, the following rules are referenced, except where otherwise noted: • AAA Commercial Arbitration Rules and Mediation Procedures (2022) in force 1 September 2022 (AAA Rules; AAA) • CPR Rules for Administered Arbitration (2019) in force 1 March 2019 (CPR Administered Rules; CPR) • JAMS Comprehensive Arbitration Rules & Procedures (2014) in force 1 June 2021 (JAMS Rules; JAMS) AAA, CPR, and JAMS—profiles AAA AAA, the oldest provider of alternative dispute resolution (ADR) worldwide, was formed following the enactment

The Local Government Information Unit (LGIU) has published a report examining the changing landscape of risk management in UK local authorities. Based on in-depth interviews with risk managers, the study highlights the increasing complexity of challenges faced by councils, including financial pressures, cybersecurity threats, climate change, and public health crises. The report emphasises the growing need for proactive and strategic approaches to risk management in local government. It explores the evolving role of risk managers and provides recommendations to foster a healthy and dynamic risk management culture across the sector. This research, supported by Browne Jacobson and ALARM, aims to enhance understanding of current risk management practices and challenges in local authorities.