Data law | UK Regulatory Outlook September 2026

UK updates

ICO transformation into Information Commission set for 30 September

On 30 September 2026, the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 bring into force the provisions of the Data (Use and Access) Act 2025 abolishing the Information Commissioner's Office and transferring its functions to the Information Commission.

In connection with this transition, the ICO consulted on its corporate strategy, which aimed to "provide a bridge" from its current approach to its future Information Commission governance model. See this Regulatory Outlook for more information.

ICO consults on draft guidance on the use of anonymisation and pseudonymisation for research, archiving and statistical purposes

The ICO has published for consultation draft guidance on the use of anonymisation and pseudonymisation for research, archiving and statistical (RAS) purposes.

The ICO reminds readers that the RAS provisions in the UK GDPR relate to the following categories of research-related processing of personal data: archiving in the public interest, scientific research, historical research and statistical purposes. Article 84B of the UK GDPR contains additional requirements for processing for RAS purposes. In particular, personal data may only be processed for RAS purposes where:

• the processing consists of the collection of personal data (whether from the data subject or otherwise);
• the processing is carried out in order to convert the personal data into information that cannot be used to identify a data subject; or
• without the processing, the RAS purposes cannot be fulfilled.

The UK GDPR also states that processing of personal data for RAS purposes must be carried out subject to appropriate safeguards for the rights and freedoms of the data subject.

In its draft guidance, the ICO provides questions to help organisations decide whether they need to anonymise or pseudonymise data for research-related purposes. It also explains the roles, responsibilities and accountability involved in the anonymisation and pseudonymisation process and what safeguards are appropriate for RAS processing. The guidance further covers the concept of synthetic data, when it is appropriate to use synthetic data for RAS purposes and what considerations to bear in mind before using synthetic data for these purposes.

The consultation closes on 19 October 2026.

ICO explores viability of a data protection regulatory sandbox for testing emerging technologies, including AI

The ICO has published findings from its research into the viability of a data protection Statutory Regulatory Sandbox. This would be an evolution of its existing regulatory sandbox (which is not statutory). It would provide innovators with time-limited derogations from certain aspects of data protection law, under ICO oversight, to test emerging technologies, including AI. Read more in the AI section.

Facial recognition in policing: ICO audit findings and recommendations

The ICO has audited five police forces in England and Wales examining their use of facial recognition technology, in light of ongoing change in how the police use this technology. The ICO's findings identify that while some good practice was observed, gaps and inconsistencies remain, and consequently make 107 recommendations covering both compliance and best practice. Read more in the AI section.