United Kingdom News

🇬🇧

The Home Office updated Immigration Enforcement's live facial recognition legal mandate as the programme moves from proof of concept to a pilot.

29 October 2026 Policy

🇬🇧

The ICO updated its detailed special-category data guidance to reflect the Data (Use and Access) Act 2025 and clarify current UK compliance requirements.

29 October 2026 Guidance

🇬🇧

The ICO reprimanded the Metropolitan Police and issued an enforcement notice over officers' use of an unapproved retail-crime intelligence platform.

14 October 2026 Enforcement

🇬🇧

Ten major AI developers made or committed to privacy changes, while the ICO opened an agentic-AI call for evidence closing on 20 November 2026.

8 October 2026 Policy

🇬🇧

TikTok withdrew two appeals, accepting the ICO's £12.7 million 2023 penalty for children's-data violations and ending its challenge to a separate information notice.

24 September 2026 Enforcement

🇬🇧

Natural Resources Wales said a spreadsheet containing diversity-monitoring information about current and former employees was inadvertently published and reported to the ICO.

4 September 2026 Breach

🇬🇧

Unclear patch responsibility and failure to act on alerts left data of up to 10,920 people, including criminal and biometric information, at risk.

12 August 2026 Enforcement

🇬🇧

The breach compromised data of 633,887 customers and employees after initial access went undetected for almost two years.

11 May 2026 Enforcement

🇬🇧

Police extracted a complainant's entire phone, disclosed irrelevant sensitive material without adequate redaction and notified the breach late.

11 March 2026 Enforcement

🇬🇧

The regulator found Reddit processed under-13s' data without a lawful basis, lacked robust age assurance and failed to complete a timely DPIA.

24 February 2026 Enforcement

🇬🇧

MediaLab lacked age assurance, a valid basis for under-13 processing and a DPIA despite offering a high-risk online service to children.

5 February 2026 Enforcement

🇬🇧

Allay Claims and ZMLUK were fined for texts and emails sent without valid consent or compliance with the soft opt-in rules.

20 January 2026 Enforcement