Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 02 JULY 2026

ICO Issues Guidance On Recognized Legitimate Interest

Mayer Brown
Mayer Brown
Contributor
Mayer Brown

Mayer Brown

Mayer Brown is a leading international law firm positioned to represent the world’s major...

View firm profile
Explore more from Mayer Brown

The UK Information Commissioner's Office has published final guidance on a new lawful basis for processing personal data under the UK GDPR, introduced by the Data (Use and Access) Act 2025. This recognised legitimate interest basis provides five pre-approved processing purposes deemed to be in the public interest, offering organisations an alternative pathway for lawful data processing in specific circumstances.

United KingdomPrivacy
Oliver Yaros
Oliver Yaros
Ellen Hepworth
Ellen Hepworth
Rebecca Keay
Rebecca Keay
Alasdair Maher
Alasdair Maher
Katie Steval
Katie Steval
Cyril Lekgetho
Cyril Lekgetho
Author LinkedIn connections

On 23 March 2026, the UK Information Commissioner's Office (the "ICO") published its final guidance on the new "recognised legitimate interest" lawful basis for processing personal data under the UK General Data Protection Regulation (the "UK GDPR"). This new lawful basis was introduced by the Data (Use and Access) Act 2025 (the "DUA Act"), which received Royal Assent on 19 June 2025, with the relevant provisions coming into force on 5 February 2026.

Background and Scope of the Guidance

The DUA Act introduces a seventh lawful basis for processing personal data: "recognised legitimate interest" under Article 6(1)(ea) of the UK GDPR. This is distinct from the existing "legitimate interests" basis under Article 6(1)(f), which remains available and is broader in scope, permitting organisations to define their own processing purposes subject to a three-part test incorporating a balancing exercise.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Visit us at mayerbrown.com

Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.

© Copyright 2026. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Ten AI Giants, One Regulator And A Lesson For Everyone Else: What The ICO’s Foundation Model Report Really Tells Us

The UK's Information Commissioner's Office has completed its supervision of major AI foundation model developers, revealing significant gaps in data protection practices and setting new expectations for legitimate interests assessments, transparency, and special category data handling. The regulator has now turned its attention to agentic AI systems, warning that autonomy is not an excuse for poor compliance and launching a call for evidence that will shape future regulatory guidance.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

To Fine Or Not To Fine: EDPB Confirms Default Position In GDPR Enforcement Should Be To Fine

The European Data Protection Board has published draft guidelines proposing a fundamental shift in GDPR enforcement: a presumption that fines should be imposed for non-minor infringements, with a deliberately low bar for establishing negligence. Organizations will need to demonstrate robust compliance programs and documented decision-making to potentially avoid penalties, as regulators move from asking "should we fine?" to "can we justify not fining?"
GlobalPrivacy
Crowell & Moring LLP
Crowell & Moring LLP
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

DOL Announces Enforcement Actions Against Employers In H-1B And PERM Fraud Probe

The Trump Administration has launched an unprecedented enforcement action suspending permanent labor certification processing for eight major employers, linking immigration sponsorship to layoff histories and recruitment practices. This development signals a fundamental shift in how the government evaluates employer access to H-1B and green card programs, with investigations already underway and subpoenas served.
United StatesEmployment and HR
Mayer Brown
Mayer Brown
Article

Trump Administration Announces New Enforcement Actions Against Employers In H-1B And PERM Fraud Probes

The Trump Administration has launched an unprecedented investigation into H-1B visa and PERM labor certification programs, with the Department of Labor's Office of Inspector General issuing dozens of subpoenas and suspending employers' ability to process applications. Federal agencies are deploying new enforcement tools including whistleblower programs and criminal prosecution threats...
United StatesImmigration
Mayer Brown
Mayer Brown
Article

SEC Staff Statement On Fair Value Measurement And Disclosure Considerations For Private Assets

The SEC Staff has issued new guidance addressing fair value measurement and disclosure practices for private credit and other illiquid assets held by registered funds and business development companies. As private credit portfolios have grown nearly 60% since 2020, reaching $270 billion, regulators emphasize the critical importance of robust valuation methodologies, transparent disclosure of significant judgments, and careful application of accounting standards when market prices are unavailable.
United StatesAccounting and Audit
Mayer Brown
Mayer Brown
Article

Contracting Opportunities And Challenges For Emerging Agentic AI Companies

Emerging providers of AI agents face unique contracting challenges as autonomous AI tools evolve beyond traditional SaaS models. This analysis examines critical issues in defining agent authority, structuring pricing models, calibrating warranties, and navigating regulatory uncertainty. How should providers balance customer expectations with the unpredictable nature of autonomous AI systems?
United StatesMedia, Telecoms, IT, Entertainment
Mayer Brown
Mayer Brown
Article

AI Regulation In Singapore And Hong Kong: A Mid-Year Checkpoint

Singapore and Hong Kong continue to regulate artificial intelligence through existing laws and voluntary frameworks rather than comprehensive AI statutes, but the first half of 2026 has brought sharper emphasis on practical controls including agentic AI governance, assurance and testing, financial-sector oversight and cyber resilience. Both jurisdictions are building concrete expectations around risk management, transparency, human accountability and operational safeguards while avoiding horizontal AI legis
GlobalStrategy
Mayer Brown
Mayer Brown