The UK Information Commissioner’s Office (ICO) has recently closed its consultation on new draft Data Protection Enforcement Procedural Guidance (the Guidance), which sets out in detail how the ICO intends to use its investigatory and enforcement powers under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

The draft Guidance is a comprehensive document that aims to bring greater clarity, transparency, and predictability to the ICO’s enforcement processes. Once finalised, the Guidance will replace the ICO’s 2018 Regulatory Action Policy (Regulatory Action Policy), providing significantly more clarity and detail on each stage of an ICO investigation and the exercise of its statutory powers.