Bye bye ICO, hello IC: What’s changed beyond the name
On 30 September 2026 the ICO formally became the Information Commission. What the new board changes, who sits on it,…
Articles
Practical guidance on UK GDPR, data protection, and privacy compliance. From ICO enforcement updates to implementation guides, we help you stay informed and compliant.
ICO confirms TikTok £12.7m children’s privacy fine is final: what online-service teams should learn
The ICO says TikTok’s £12.7m children’s privacy fine is final. Here are the practical controls online-service teams should test.
EU withdrawal pages: what you need to know
A practical guide to EU online contract-withdrawal functions from 19 June 2026, with a clear distinction from GDPR cookie-consent withdrawal.
Securitas Direct fined €100,000: why data-subject rights must be genuinely free
The Spanish DPA fined Securitas Direct €100,000 after a chargeable phone number made data-subject rights harder to exercise. Here is…
Irish DPC fines HSE €645,000 over insecure paper medical-record storage
In late 2023, people got into two disused psychiatric hospitals in Ireland and filmed what they found: boxes of patient…
CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests
On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to…
CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach
A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed…
P&O Ferries data breach: lessons for customer communications
P&O Ferries reportedly exposed passenger details through a text message. What can organisations learn about safe sharing, staff training and…
AliExpress and silent audio fingerprinting: what the finding means for online tracking
A recent investigation into AliExpress is a useful reminder that online tracking is not limited to cookies or visible consent…
Data Protection Training Matrix: How UK Employers Can Map Training by Role
A completion spreadsheet can show who finished a course. It cannot, by itself, show that people received training suited to…
Dutch AP fines Uber €825m: what meaningful human review looks like
The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21…
Data protection training for staff: a practical UK employer checklist
Data protection training for staff works best when it is part of an everyday operating routine, rather than a generic…
ICO action against the Metropolitan Police: why training and assurance must be demonstrable
An ICO enforcement notice and reprimand issued to the Metropolitan Police Service (MPS) offer a practical reminder for any organisation…
Agentic AI & GDPR: a practical guide to GDPR compliant adoption of AI
AI agents such as a support bot that can read customer records, update customer orders and provide customers with the…
ICO investigation leads to sentence for unlawful council-record access: what employers should do
A new ICO case is a useful reminder that personal-data risk is not limited to phishing, lost devices or external…
CNIL connected-vehicle location rules: what fleet managers and telematics providers should check
A connected car, van, or scooter generates location data every time it moves. Fleet dashboards, rental recovery tools, and telematics…
ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers
On 8 July 2026, the ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and Jacksons Marketing Ltd £130,000 after…
AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects
A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine…
Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained
Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for…
When exactly can UK marketers use the soft opt-in?
Unsolicited email and SMS to people based in the UK “individual subscribers” normally needs explicit consent under UK ePrivacy/PECR electronic…