The Lens

2/27/2026 10:03:21 AM

Children’s privacy in focus: ICO fines Reddit £14.47m

By Bryony Bacon Lewis Mack

Whereas 2025 saw the ICO’s penalties firmly aimed at data security and cyber breaches, this year has seen the issue of two significant...

2/19/2026 11:11:54 AM

How does Ofcom set penalties under the OSA? Insights from its recent decisions

By Will Manley Bryony Bacon

With intense public and political scrutiny falling on online safety enforcement, triggered by X’s Grok AI chatbot, enforcement action...

2/19/2026 11:03:47 AM

The EU Data Act in practice: Key recent developments

By Will Manley Peter Elkin

Support for Data Act compliance has been bolstered in recent months by the launch of the EU’s new Data Union Strategy, which aims to...

2/6/2026 1:47:29 PM

ICO updates on plans for supporting economic growth as key parts of the DUA Act come into force

By Cindy Knott Bryony Bacon

This time last year, the ICO published a letter to the UK government setting out five new initiatives to support innovation and sustain...

1/27/2026 2:28:14 PM

ICO publishes report on agentic AI and its data privacy implications

By Lily Latimer Smith

The Information Commissioner’s Office (ICO) has published the latest report in its Tech Futures series on the topic of agentic AI (the...

1/26/2026 11:02:42 AM

Major update to ICO international transfers guidance: key takeaways for organisations

By Bryony Bacon

The UK Information Commissioner’s Office (ICO) has published a major update to its international transfers guidance to help organisations...

1/12/2026 12:06:55 PM

ICO publishes new guidance on data subject access requests

By Cindy Knott

The Information Commissioner’s Office (ICO) has published updated guidance on data subject access requests (DSARs), reflecting both...

12/11/2025 9:27:38 AM

EU proposes single-entry point for cyber incident reporting, but is it really “report once, share many”?

By Laura Houston Richard Jeens Christopher Burns +1 more...

As part of the recently announced Digital Omnibus simplification package (see our blog on that here), the European Commission plans to...

11/24/2025 5:05:38 PM

Preventing Core Technical Failures: Lessons from the Capita Breach

By Rebecca Cousin Natalie Donovan Peter Elkin

The Information Commissioner’s Office (ICO) investigation into Capita’s 2023 cyber attack has concluded with a £14 million fine for the...

11/20/2025 2:37:30 PM

What changes does the Digital Omnibus make to the EU GDPR?

By Bryony Bacon

Major changes to the EU’s data protection regime are included in the European Commission’s Digital Omnibus package, launched on 19...

11/20/2025 11:29:52 AM

BREAKING: EU announces major digital and data simplification package and delay to AI Act

By Laura Houston Christopher Burns

The European Commission has published its long-awaited “Digital Omnibus” simplification package, with significant changes proposed to a...

11/17/2025 2:50:11 PM

You've been warned! Learnings from non-cyber regulatory action and litigation

By Cindy Knott

Despite cyber-attacks dominating the media headlines this year, including against Marks and Spencer, the Co-op and Jaguar Land Rover, the...

10/21/2025 1:32:18 PM

Can Brussels change? One year after Draghi – the EU's Digital Simplification Package

By Christopher Burns

On 16 September 2025, almost a year after the European Commission published the landmark Draghi Report on lagging European...

10/20/2025 10:28:05 AM

London calling: Lessons on the GDPR’s global reach from the Upper Tribunal (ICO v Clearview)

By Bryony Bacon

Earlier this month, the Upper Tribunal (UT) delivered its decision, in the latest instalment of the long-running attempt by the ICO to...

9/29/2025 6:54:29 PM

Cyber supply chain risk but not as we know it….

By Natalie Donovan

The recent cyber attack at JLR not only demonstrates the debilitating nature of a severe cyber attack, but highlights the devastating...

9/17/2025 12:18:03 PM

Cookie catch-up: What you need to know about the CNIL’s Google and Shein fines (and other summer developments)

By Bryony Bacon

At the start of September, the French data protection authority (the CNIL) issued record breaking cookie penalties against Google (€325...