GDPR Questions Answered: Do We Need Consent To Hold Information In A Database?

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.

Explore comprehensive legal insights and expert commentary across diverse practice areas and industries. Access thought leadership through written articles and podcast discussions that address current legal developments and emerging trends.

In the digital age, data privacy is a critical concern for businesses and individuals alike. A key element of any organisation's data protection strategy is its privacy policy.

From 2 August 2026, the EU AI Act requires businesses to disclose when people are interacting with AI systems, mark synthetic content for detection, label deepfakes, and inform individuals...

The Data (Use and Access) Act 2025 (the DUAA) officially became law in June 2025, with a phased enforcement model under which different provisions take effect at different times.

On 30 September 2026, the Information Commissioner's Office formally becomes the Information Commission. It is the most significant structural change to the UK's data protection regulator in its history, and yet, many organisations are wondering what practical implications this change will have. Here's what you need to know.

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.

The Information Commissioner's Office has launched a consultation on draft guidance addressing anonymisation and pseudonymisation for research, archiving and statistical purposes. This guidance provides critical insight into how organisations should apply data minimisation principles in modern research practices, including AI development, trusted research environments, and synthetic data generation.

The UK's Information Commissioner's Office has opened a public consultation on draft guidance addressing anonymisation and pseudonymisation techniques for processing personal data in research, archiving, and statistical contexts. The guidance explores critical distinctions between anonymous and pseudonymous data, outlines required safeguards under UK GDPR, and examines emerging technologies including synthetic data and privacy-enhancing tools.

The European Commission has launched a privacy-preserving age-verification app designed to help platforms comply with the Digital Services Act, but Member States are simultaneously implementing divergent national age...

The UK's right-to-work regime is undergoing a fundamental transformation that will extend compliance obligations far beyond traditional employment relationships. From 1 October 2026, businesses engaging contractors, agency workers, platform-based workers, and complex supply chains will face new liability risks that travel up entire contracting chains. Understanding these changes and implementing the required contractual terms, substitution controls, and identity verification systems is now critical for orga

Meta has agreed to pay up to $18 billion over 10 years to settle claims by 52 US state and territory attorneys general in the largest state consumer-protection settlement in American history outside tobacco. The settlement imposes binding child-safety obligations including time limits and age assurance, but leaves the core algorithmic feed unchanged and raises questions about whether this represents genuine accountability or a commercially managed outcome.

The High Court has awarded the Swatch Group US$11.6 million in negotiation damages against Samsung for trade mark infringements involving watch face apps on the Galaxy App store. Rejecting both parties' extreme valuations of US$170 million and US$301, the court established important principles for assessing damages when brand owners don't license their marks and no comparable market royalties exist.

From 30 October 2026, independent trade unions will gain statutory rights to access workplaces - both physically and digitally - regardless of existing union membership or recognition. With tight statutory deadlines for responding to access requests and penalties reaching £500,000 for repeated breaches, employers face a significant shift in how unions can establish themselves in previously non-unionised workplaces.

An independent Premier League Commission has found Manchester City in breach of financial rules spanning nine seasons, with findings that the club artificially inflated revenues and reduced costs by over £900 million. The decision marks what the Premier League describes as the most significant case in its history, though Manchester City strongly disputes the findings and intends to appeal, setting the stage for further proceedings that could reshape English football's regulatory landscape.

AI has fundamentally altered how reputation is shaped, with AI-powered search engines now delivering authoritative-seeming summaries rather than traditional search results. From deepfakes and voice cloning to coordinated review bombing and bot-driven harassment campaigns, the threats are evolving rapidly—but so are the defensive tools available to those who understand how to deploy them strategically.

In a landmark ruling, the English Commercial Court has determined that insurers must continue advancing defence costs under D&O policies even when fraud allegations are pending, provided a non-avoidance clause is present. The decision addresses whether such clauses violate public policy and establishes that insurers cannot withhold coverage until fraud is either admitted or proven by final court decision.

The High Court's landmark ruling in R (University of Sussex) v Office for Students has fundamentally reshaped how the OfS regulates freedom of speech in higher education, leading to revised guidance that requires holistic policy assessment and proper consideration of remedial actions. With the new free-speech complaints scheme now operational, institutions face heightened scrutiny of their policies and must ensure their frameworks protect lawful speech while meeting equality obligations.

AI-generated content poses unprecedented reputational threats, from deepfakes to coordinated bot campaigns. While English law lacks AI-specific remedies, existing legal frameworks—including harassment protections, defamation claims, and the Online Safety Act 2023—offer powerful tools for those who act decisively. The emerging question of AI liability itself remains untested, focusing attention on the human decisions behind AI deployment.

Antonia and Jonny Philp transformed a painful personal experience into a purpose-driven skincare company that supports healthcare professionals facing the same challenges. Through their innovative business model, they've delivered hundreds of thousands of months of free hand care to NHS workers while building a family and a brand with genuine impact.