Court Confirms Broad Data Security Duty: Controllers Must Protect Against Third-party "Jigsaw" Identification

In DSG Retail Limited -v- The Information Commissioner [2026] EWCA Civ 140, the Court of Appeal delivered a landmark judgment (19 February 2026) clarifying the scope of the security duty imposed on data controllers under data protection law.

The appeal arose from the Information Commissioner's challenge to an Upper Tribunal decision which had narrowed the duty imposed by the seventh data protection principle (DPP7) under the Data Protection Act 1998 (which was the data protection framework in force at the time of events in the case).

The central question was whether a data controller is required to take appropriate technical and organisational measures (ATOMs) against unauthorised or unlawful processing by a third party, where the data constitute "personal data" in the hands of the controller but not in the hands of the third party. The Court of Appeal unanimously allowed the Information Commissioner's appeal, holding that the security duty applies to all data