Arbitration analysis: The impact of this decision by the DIFIC Court of Appeal provides that the Dubai International Financial Centre Courts (DIFIC Courts) cannot maintain an injunction with respect to foreign court proceedings where there was no underlying jurisdiction to do so as arising out of established DIFIC jurisdiction. The judgment also confirms that references to ‘Duba’ in an arbitration agreement do not necessarily imply a reference to the DIFC court’s jurisdictional powers. Written by Dr Gordon Blanke, founding principal, Blanke Arbitration Dubai/London/Paris and associate tenant, No 5 Barristers’ Chambers, and Vikramaditya Singh, associate, Blanke Arbitration.

Commercial analysis: The Digital Markets, Competition and Consumers Act 2024 (DMCCA 2024) received royal assent during the ‘wash up’ period, following the announcement of the July General Election. One very significant area of focus in the DMCCA 2024 (following the UK Government's 2021 consumer protection consultation and the earlier Penrose report) is subscription contracts. Subscription contracts are big business, with estimated consumer spending in the UK on subscriptions said to be between £28bn and £34bn a year across multiple sectors, with eight in ten UK consumers having at least one subscription. The reforms in the DMCCA 2024 were prompted by concerns that consumers may be spending as much as £1.8bn per year on subscriptions they do not think are good value for money and can find difficult to exit when they no longer require the relevant goods/services. The new rules are expected to come into force towards the end of 2024, once regulations are passed. Richard Shaw, partner, Anna Blest, senior knowledge lawyer, and Krish Raichura, associate, all at Bryan Cave Leighton Paisner LLP, discuss the key changes and how these will affect the subscription contract model below.

This Practice Note sets out the plans of the Department for Work and Pensions (DWP) for the development of a permanent regime for the regulation of defined benefit (DB) superfunds. For information on what DB superfunds are, the merits of using them, consolidation models and proposals to create a public sector consolidator through the Pension Protection Fund (PPF), see Practice Note: DB consolidation—what are DB superfunds? For information on the interim regime developed by the Pensions Regulator (TPR) pending the development of the DWP’s permanent regime, see Practice Note: TPR’s interim regime for DB superfunds. For information on considerations applicable to trustees and employers when contemplating a transfer to a DB superfund under the interim regime, see Practice Note: Transfer to a DB superfund—trustee and employer considerations. Development of permanent regime for DB superfunds DB consolidation gained real momentum when the DWP published a Green Paper ‘Defined benefit pension schemes: security and sustainability’, in February 2017 and followed it with a White Paper, ‘Protecting defined benefit pension schemes’, in March 2018. These publications

This Practice Note provides a summary of the key aspects of the Data (Use and Access) Act 2025 (DUAA 2025) from an information law perspective. DUAA 2025 received Royal Assent on 19 June 2025 and came partly into force on that date. The majority of the provisions of DUAA 2025 require secondary legislation to be made in order to come into force. For further information on the commencement timetable for DUAA 2025, see: LNB News 19/06/2025 46, LNB News 28/07/2025 33 and the section on Commencement below. See the Parliament website for the text of DUAA 2025 and associated explanatory notes. DUAA 2025 contains seven parts: • Part 1 covers access to customer and business data and aims to enable ‘smart data’ to be used in sectors other than its current use in open banking in the finance sector • Part 2 regulates the provision of digital verification services through the creation of a trust framework, a register of providers, an information sharing gateway, and a trust mark • Part 3 puts the national

Corporate Crime analysis: The Data (Use and Access) Act 2025 (DUAA 2025) introduces sweeping reforms to the UK’s data protection regime, amending the UK General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the ePrivacy Regulations. It introduces a new lawful basis for ‘recognised legitimate interests’, restructures purpose limitation rules, modernises international transfer tests, and aligns PECR 2003 fines with UK GDPR levels. Automated decision-making restrictions are eased, subject to safeguards, while protections for children’s data are strengthened. Lorna Cropper of Fieldfisher provides an introduction to DUAA 2025 to help corporate crime lawyers keep up to date with this fast moving area of law.

This Practice Note assesses the impact of the changes to UK data protection and ePrivacy law made by the Data (Use and Access) Act 2025 (DUAA 2025) which received Royal Assent on 19 June 2025 and partly came into force on that date. Many of the obligations of DUAA 2025 do not come into force until the Secretary of State passes regulations for such purpose and such regulations are scheduled to be passed in four different stages following Royal Assent (see: LNB News 28/07/2025 33). To track such developments, see Practice Note: Data (Use and Access) Act—tracker. Many of the key changes to data protection and ePrivacy law came into force on 5 February 2026 (see: LNB News 04/02/2026 26 and LNB News 04/02/2026 13). See the Parliament website for the text of DUAA 2025 and associated explanatory notes. The provisions of DUAA 2025 include reforms to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018 (DPA

Before the EU General Data Protection Regulation came into force on 25 May 2018, the Data Protection Act 1998 (DPA 1998) outlined the data protection obligations for pension scheme trustees and employers when 'processing' 'personal data' as 'data controller' (see: Terminology below). For more information on the data protection requirements applicable in a pensions context on and from 25 May 2018, see Practice Note: Data protection for pensions lawyers. Terminology Terms commonly used within the DPA 1998 included: • Processing: all-encompassing term that includes obtaining, recording, holding, using, disclosing or erasing data • Data subject: an individual who is the subject of the data held. Typical data subjects in a pension scheme are scheme members, and any beneficiaries or dependants of the members • Personal data: data relating to a living individual who can be identified from that data • Data controller: person/organisation controlling the data and responsible for complying with the provisions of the DPA 1998. For pension schemes, it was typically the trustees of an occupational pension scheme who,

This Practice Note introduces the UK’s Data Protection Act 2018 (DPA 2018). For higher-level introductions to data protection law in the UK, see Practice Note: Data protection law—new starter guide. The UK data protection law collection collates further general guidance on data protection and is a recommended starting point for research. In brief In summary, the DPA 2018 itself currently governs: • the processing of personal data within the scope of the UK GDPR regime, supplementing the core provisions set out in the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), including additional provisions relating to: ◦ lawful basis for processing ◦ processing on the basis of relevant international law ◦ processing special categories of personal data and criminal offence data ◦ credit reference agencies ◦ accreditation of certification providers ◦ certain contractual terms relating to health records ◦ exemptions from generally applicable obligations under the UK GDPR regime ◦ specific laws relating to children’s consent in Scotland ◦ transitional changes following Brexit • the

The Data Protection Act 2018 (DPA 2018) addresses a number of distinct data protection regimes in UK data protection law: • general processing of personal data subject to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) • processing of personal data by competent authorities for law enforcement purposes • processing of personal data by the intelligence services This Practice Note deals with the parts of the DPA 2018 that focus on general processing in connection with the UK GDPR. It focuses on aspects which are likely to be most relevant to commercial organisations and, for example, does not focus on the special rules which apply to manual unstructured processing by certain public sector bodies, in relation to immigration or for defence or national security purposes. For an introduction to the UK GDPR, see Practice Note: The UK General Data Protection Regulation (UK GDPR). The UK GDPR regime is the replacement to the preceding regime under the General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR),

ARCHIVED: This archived Practice Note provides information on the Data Protection Act 2018 (DPA 2018) prior to 11 pm on 31 December 2020. As of that date this Practice Note is for background information only and is not maintained. For guidance on the DPA 2018 from that date, see Practice Note: The Data Protection Act 2018 and the UK GDPR. Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continued to be subject to EU law until 11 pm on 31 December 2020. During this period, the GDPR applied in the UK and the UK generally continued to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and its impact on data protection laws,

This timeline sets out key dates and information relating to the development, implementation and reform of the Data Protection Act 2018 (DPA 2018). For guidance on DPA 2018, see Practice Note: The Data Protection Act 2018 and for a comprehensive introduction to data protection law in the UK, collating key practical guidance, see: UK data protection law collection. This tracker includes information about the more recent operation of DPA 2018 under the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) (including after amendment by the Data (Use and Access) Act 2025 (DUAA 2025)), and also on its earlier operation under the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) regime (ie before 11 pm on 31 December 2020). For guidance on the latter, and on amendments to DPA 2018 relating to Brexit, see Practice Notes: Brexit—implications for data protection [Archived], Information Law—Brexit tracker [Archived]—Data protection and The Data Protection Act 2018 and the UK GDPR. Key developments Date Summary 12 May 2026 The Data Protection Act 2018 (Code of Practice on Artificial

ARCHIVED: This archived Practice Note provides information about the Data Protection and Digital Information Bill introduced to Parliament in March 2023. This bill did not receive Royal Assent before the dissolution of Parliament on 30 May 2024 and therefore fell from Parliamentary business—see LNB News 29/05/2024 66 and News Analysis: General election announced for 4 July 2024. This Practice Note is for background information only and is not maintained. For updates in relation to data protection reforms more generally, see Practice Notes: The Data Protection Act 2018—timeline and UK ePrivacy law reform—tracker. This Practice Note provides a summary of key aspects of the Data Protection and Digital Information Bill as published on 6 December 2023 (the Bill), which proposes reforms to the: • United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) • Data Protection Act 2018 (DPA 2018) • Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003), SI 2003/2426 The Bill was introduced to Parliament during the 2022–23 session under the name ‘Data Protection