UK Report November 2025

UK Report - Issue 142

05 November 2025

UK Report November 2025

Overview

Contents

COMMENTS

• Cyber-extortion: Pro-active and reactive responses
• Are you juggling many hats?

LEAD STORIES

• DUAA introduces a new complaints-handling requirement
  Annabel Gillham and Dan Alam of Morrison & Foerster LLP explain what controllers need to know.
• Navigating the new ‘recognised legitimate interest’ lawful basis of public task disclosure
  Olympia Critchley and Emma Erskine-Fox of TLT LLP analyse the new recognised legitimate interest ground under the Data (Use and Access) Act.

NEWS

• Getting ready for the Data (Use and Access) Act
• ICO annual online conference shows its priorities

ANALYSIS

• Beyond cyber – beware of human error and process pitfalls

MANAGEMENT

• The ICO is swamped. Is it time for a UK Data Protection Ombudsman?
• UK GDPR certification under Art. 42: Demonstrating accountability and building trust

NEWS IN BRIEF

• ICO consults on new soft opt-in rules for charities
  
• EDPB issues Opinions on EU Commission’s UK draft adequacy decisions
  
• ICO fines Capita £14m for data breach affecting more than 6 million people
  
• Meta and ICO agree on a pay or consent model
  
• Imgur withdraws from the UK to avoid ICO fine
  
• Upper Tribunal judgment on Clearview AI Inc confirms ICO reach