Data law | UK Regulatory Outlook October 2026

UK updates

ICO sets out approach to foundation models and launches call for evidence on agentic AI

The Information Commission's Office (ICO) has published a report setting out its approach to foundation model development, The ICO recognises that interpretation and application of existing data protection law can be challenging in some areas, particularly where developers are processing special category data. The regulator is continuing to engage with government and industry on those more challenging issues. The report follows the UK government's recently closed call for evidence on how personal and non-personal data regulation interacts with AI.

The ICO has also launched a call for evidence seeking views on how data protection law applies to agentic AI. While the existing regulatory expectations continue to apply, the regulator highlights that agentic AI systems may pose heightened data minimisation and security risks in the absence of appropriate safeguards. The evidence gathered will inform the ICO's future guidance on this topic and its forthcoming statutory code of practice on AI and automated decision-making.

See more in the AI section.

ICO publishes guidance on smart data schemes

The ICO has published guidance for smart data scheme designers to provide regulatory clarity on aspects of smart data schemes that involve the processing of personal data. The guidance covers the different roles within a smart data scheme, lawful basis, transparency, data minimisation, data subjects' rights, security, complaints processes, and data protection by design and by default.

This guidance follows broader government activity in this area. In March, the government, under Sir Keir Starmer's leadership, published its smart data strategy. In July, it launched a multi-sector call for evidence on smart data schemes, which closed on 1 October.

More recently, the Department for Energy Security and Net Zero launched a consultation on the scope, design and implementation of a smart data legislative framework for the energy sector. The consultation closes on 8 January 2027. It will be used to make regulations using powers under the Data (Use and Access) Act 2025, provided the statutory framework for smart data schemes across sectors. This gives the secretary of state and the Treasury powers to introduce legal requirements for the creation and governance of such schemes via secondary legislation.

ICO chief executive explores privacy and transparency challenges posed by smart glasses

The ICO's chief executive, Paul Arnold, has published a blog post exploring the challenges associated with smart glasses, from data protection law to "social norms, public expectations, safety by design, and the responsibilities that come with developing, selling and using these products."

Mr Arnold poses a number of questions, including how individuals can understand, avoid or object to data processing if they cannot identify when information is being captured; how unnecessary data collection in physical spaces might be avoided by default; what forms of transparency and control could genuinely work for everyone; and how investment in safeguards can be ensured alongside investment in capabilities.

He notes that smart glasses are not the first or last technology that can be used responsibly or irresponsibly once placed in the hands of the public. He observes that regulation can only go so far. New social norms and expectations will need to emerge, potentially supported by new product standards or laws addressing specific forms of misuse. Technology companies need to innovate not only in product features but also in the systems that support public safety and trust, and that privacy by design must be more than a compliance exercise.

The challenge, he concludes, is how to maintain meaningful transparency, accountability, control and data minimisation as technology becomes "more capable, more personal and less visible."

EU updates

European Data Protection Board publishes statement on smart glasses

The European Data Protection Board (EDPB) has published a statement on the data protection challenges of smart glasses, setting out preliminary reflections on their privacy implications. The statement echoes the UK ICO's concerns about the capacity of smart glasses to process personal data in ways that may be difficult for data subjects to perceive or control.

EDPB publishes guidelines on GDPR fining methodology

The EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the EU General Data Protection Regulation (GDPR). The guidelines aim to harmonise the methodology for determining whether an administrative fine should be imposed in addition to, or instead of, other corrective measures available under article 58(2) of the EU GDPR, such as warnings, reprimands, orders, limitations including bans, and withdrawal of certification.

The EDPB has outlined a five-step methodology for supervisory authorities to determine whether an administrative fine should be imposed for an infringement of the GDPR.

First, a data protection authority (DPA) verifies whether the infringement can lead to a fine, by finding support either directly in the GDPR or in national law. Second, the DPA determines whether the party under investigation may be fined for the infringement in question. Whether the controller or the processor is liable depends on who is bound by the breached provision.

Third, it assesses whether the infringement has been committed intentionally or negligently, since a culpable infringement is a condition for the imposition of a fine, and then, fourth, it assesses possible aggravating and mitigating factors. Where the infringement is minor, a fine will generally not be imposed; where it is not, there is a strong presumption in favour of imposing a fine.

Finally, the DPA assesses whether imposing an administrative fine would be effective, proportionate and dissuasive. In doing so, the DPA may consider whether, in the specific case, there is a reason to deviate from the standard approach.

The guidelines also provide an overview of the corrective powers available to national DPAs, explaining their purpose, scope and how they relate to one another.

The guidelines are open for public consultation until 13 November.

EDPB publishes guidelines on the interplay between digital services and data protection rules

The EDPB has published the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the EU GDPR, following public consultation.

A number of provisions of the DSA specifically refer to the protection of personal data, as well as to definitions and concepts under the GDPR, in the context and for the purpose of implementing the DSA's regulatory objectives. For example, articles 26(3) and 28(2) of the DSA refer to the definition of profiling under article 4(4) of the GDPR when imposing prohibitions on certain types of advertisements by online platforms. The prohibition in article 26(3) of the DSA also relies on the catalogue of special categories of personal data under article 9(1) of the GDPR.

The guidelines aim to clarify how intermediary service providers should interpret and apply the GDPR when processing personal data in contexts covered by the DSA.