United Kingdom

Section 138 of the Data (Use and Access) Act 2025 inserts new sections 66E to 66H into the Sexual Offences Act 2003.

Section 66E makes it an offence for a person intentionally to create a 'purported intimate image' of another adult without that person's consent, and section 66F makes it a separate offence intentionally to request the creation of such an image, or to request that an image include or exclude a particular thing, without consent; the request offence is committed regardless of whether the image is ever created, of whether it is also requested by someone else, and regardless of where in the world the requester or recipient of the request is located.

A 'purported intimate image' is an image that appears to be, or to include, a photograph or film of the person, but is not, or is not only, an actual photograph or film of them, and that appears to show an adult in an intimate state; a reference to an image expressly includes data stored by any means which is capable of conversion into an image, photograph or film.

Modifying an existing photograph or film of a person does not fall within the offence unless it adds an intimate element, or a person, not shown in the original. Both offences carry a defence of reasonable excuse, and the Secretary of State must review the operation of that defence and lay a report before Parliament within two years of commencement. Section 138 came into force on 6 February 2026.

UK GDPR Articles 33 and 34 retain the same 72-hour and without-undue-delay structure as EU GDPR, with no threshold for how serious a breach must be before it is notifiable. The DUA Act shortened the separate PECR breach-notification window for telecoms and ISP-type breaches from 24 hours to 72 hours, in force 20 August 2025, aligning it with the UK GDPR timeline, and raised the maximum PECR fine to GBP 17.5 million or 4 percent global turnover, up from GBP 500,000.

The UK retained a copy of the General Data Protection Regulation (GDPR) at Brexit (UK GDPR) alongside the Data Protection Act 2018 (DPA 2018), but that copy has now materially diverged: the Data (Use and Access) Act 2025 (DUA Act, Royal Assent 19 June 2025), whose main data protection reforms took effect 5 February 2026, added a new closed-list "recognised legitimate interests" lawful basis (Article 6(1)(ea)) needing no balancing test, for purposes such as safeguarding, crime prevention, emergencies, national security, direct marketing, and intra-group administrative sharing.

This basis is unavailable to a public authority exercising its own core functions, and has no equivalent in the EU GDPR Article 6 list.

The European Commission's own adequacy decisions for the UK were renewed 18 December 2025 and now run to 27 December 2031. For UK-outbound transfers, the ICO administers its own International Data Transfer Agreement (IDTA) and IDTA Addendum as the appropriate-safeguards mechanism where no UK adequacy regulation covers the destination.

The DUA Act restructured UK GDPR's transfer chapter: the original Article 44 was omitted and replaced from 5 February 2026 by a new Article 44A, which requires that a transfer either be approved by regulations, made subject to appropriate safeguards, or made in reliance on a derogation for specific situations, the same three-track adequacy, safeguards, or derogation structure as EU GDPR Chapter V, run through the UK's own instruments rather than the EU's. This is a real, structured condition on outbound transfer, not an absence of restriction.

Before the DUA Act, UK GDPR Article 22, inherited unchanged from EU GDPR, generally prohibited a decision based solely on automated processing that produces legal or similarly significant effects, subject to narrow exceptions.

Section 80 of the DUA Act replaced Article 22 with four new articles, 22A to 22D, in force from 5 February 2026: solely automated significant decisions are now permitted generally, with the controller required to inform the individual in advance, provide a meaningful human review on request, and let the decision be contested.

The general prohibition now applies only where the automated processing relies entirely or partly on special category data or on the new recognised legitimate interests basis. A related statutory duty, S.I. 2026/425 (made 16 April 2026, in force 12 May 2026), requires the ICO to prepare and publish a binding Code of Practice on AI and automated decision-making. The ICO's own non-binding draft guidance was under public consultation from 31 March to 29 May 2026.

That still-unmade Code is recorded on this same row rather than as a separate instrument, since it exists specifically to implement this reform and does not yet have content of its own to describe.

UK GDPR's own definition of 'controller', now at Article 4(1)(7) following the DUA Act's renumbering of Article 4, names a public authority, agency or other body on the same footing as a natural or legal person, so these Articles 22A to 22D automated decision-making duties bind a government body exactly as they bind a private one.

The Information Commissioner's Office (ICO) is the UK's single supervisory authority, unlike Germany's 17-authority structure, with UK GDPR Article 83 fines up to the greater of GBP 17.5 million or 4 percent of global turnover. Section 169 DPA 2018 supplies a private right of action for contravention of data protection legislation other than UK GDPR itself, while UK GDPR's own Article 82 covers contraventions of the Regulation directly; both cover material and non-material damage.

The UK's own Supreme Court has gone further than the CJEU in limiting what counts: Lloyd v Google LLC [2021] UKSC 50 (10 November 2021) unanimously rejected a representative claim brought on behalf of 4.4 million iPhone users, holding that compensation for a non-trivial data protection breach requires the individual to show tangible financial loss or distress, not a bare loss of control alone, and that such a claim cannot succeed without showing unlawful use and resulting damage for each individual claimant rather than the group as a whole.

The Court of Appeal held South Wales Police's automated facial recognition trials unlawful, for breach of Article 8 ECHR, the Data Protection Acts 1998 and 2018 (no adequate legal framework, no proper Data Protection Impact Assessment), and the public-sector equality duty.

This is a public-authority case: it establishes that biometric surveillance deployment needs a proper legal framework, not just a lawful basis, and it is recorded here as applying to government even though the underlying UK GDPR and DPA 2018 biometric rules apply to both public and private actors.

Biometric data used for identification, fingerprints, facial templates, voiceprints, is special category data under UK GDPR Article 9, the same definition as EU GDPR.

The DPA 2018's Schedule 1 supplies the UK's own list of Article 9(2)(g) substantial public interest conditions, 23 conditions in Part 2 of Schedule 1, in addition to explicit consent, employment and social-security processing authorised by law, vital interests, not-for-profit bodies, data manifestly made public, legal claims, health and social care, public health, and archiving and research.

The ICO's own "Biometric recognition" guidance, published in final form 5 March 2024, states that biometric data becomes special category personal data from the moment of collection once a purpose of unique identification has been determined for it.

The Data (Use and Access) Act 2025 inserted a new Article 11A UK GDPR giving the Secretary of State a ministerial power to expand, by regulation, what description of processing is subject to Article 9's prohibition or its exceptions; no such regulation had been made as of the date shown. The ICO fined Clearview AI Inc GBP 7,552,800 for, among other findings, failing to meet the higher data protection standard biometric data requires.

In October 2025, the Upper Tribunal held that the First-tier Tribunal had wrongly found Clearview's processing outside UK GDPR's material scope, restoring the ICO's jurisdiction to have issued the fine and enforcement notice and remitting the substantive appeal against them to the First-tier Tribunal for determination.

Section 1 makes it an offence for a person to cause a computer to perform any function with intent to secure access to a program or data, where that access is unauthorised and the person knows it is unauthorised. Section 17(5) defines access as unauthorised if the person is not themselves entitled to control access of that kind and does not have consent from someone who is; section 17(8) applies the same test, in materially the same words, to an act done in relation to a computer more generally.

Neither definition conditions unauthorised access on defeating a technical security measure. No reported UK case has been located establishing how section 1 applies to the automated collection of content from a public, unauthenticated website that imposes no access control.

Section 29A permits a person with lawful access to a work to make a copy of it for computational analysis, without infringing copyright, but only where the copy is made so that a person with lawful access can carry out that analysis for the sole purpose of non-commercial research, and the copy carries a sufficient acknowledgement.

The copy becomes an infringing copy if it is transferred to anyone else, other than with the copyright owner's authorisation, or used for any purpose beyond that non-commercial research purpose. A contract term purporting to prevent or restrict the making of a copy that this section would otherwise permit is unenforceable.

Because the exception is limited to non-commercial research, crawling third-party websites to collect training data for a commercial AI model does not fall within it, and depends instead on a licence or the rights holder's consent under the general copyright framework.

The government's Report on Copyright and Artificial Intelligence, published 18 March 2026 following its 2024-25 consultation, stated that a broad text-and-data-mining exception with a machine-readable opt-out is no longer the government's preferred way forward, so the position described here is expected to remain the status quo for the near term.

Regulation 13 creates a sui generis property right, database right, in a database where there has been substantial investment, whether financial, human or technical, in obtaining, verifying or presenting its contents; the right does not depend on the database or its contents being a copyright work.

Regulation 16 provides that a person infringes database right if, without the rightholder's consent, they extract or re-utilise all or a substantial part of the database's contents, and that the repeated and systematic extraction or re-utilisation of insubstantial parts may itself amount to extracting a substantial part. Regulation 12 defines extraction as the permanent or temporary transfer of the contents to another medium by any means or in any form.

The same regulation defines re-utilisation as making the contents available to the public by any means.

Regulation 17 gives database right a term of fifteen years from the end of the calendar year in which the database was completed, or from when it was first made available to the public if earlier, and a substantial change to the database's contents, including one built up from successive additions, deletions or alterations, that amounts to a substantial new investment gives the resulting database its own new fifteen-year term.

A manufacturer of a UK consumer connectable product, an internet- or network-connectable product that is not excepted, must comply with the security requirements of the 2023 Regulations, and an importer or distributor who supplies the product must not do so while aware of a manufacturer compliance failure.

Schedule 1 of the Regulations bans universal or easily guessable default passwords and requires the manufacturer to publish a point of contact for reporting a security issue, with a commitment on when the reporter will get an acknowledgment and status updates. The manufacturer must publish the minimum period for which security updates will be provided. That published period cannot later be shortened once it is published.

The duties reach firmware, software pre-installed on the product, and companion software that must be installed for the product's intended purpose. The reporting-contact and update-period duties do not reach the software of a smartphone or a cellular-capable tablet computer. The excepted-products schedule separately excepts a desktop computer, a laptop computer, and a non-cellular tablet computer, unless the product is designed for a child under 14.

It also excepts an electric-vehicle charge point, most medical devices, and an assured smart-meter product from the regime entirely.

The Secretary of State, acting through the Office for Product Safety and Standards under a memorandum of understanding with the Department for Science, Innovation and Technology, enforces the regime with compliance, stop and recall notices and can impose a civil monetary penalty of up to the greater of 10,000,000 pounds sterling or 4% of a person's qualifying worldwide revenue.

OPSS guidance states a further daily penalty of up to 20,000 pounds sterling for continuing non-compliance with an enforcement notice. Failing to comply with an enforcement notice is separately a criminal offence carrying a fine.

Ofcom's statutory guidance under section 82 of the Online Safety Act 2023 sets out what counts as highly effective age assurance for Part 5 pornography providers, naming photo ID matching, facial age estimation, credit card checks, open banking checks, and mobile network operator checks as capable methods, and stating that self declaration or a basic checkbox is not sufficient.

Requires providers that publish or display their own, non-user-generated pornographic content to ensure, using age verification or age estimation or both, that children cannot normally encounter that content. The method used must be highly effective at correctly determining whether a user is a child, and providers must keep written records and publish a public statement on the methods used. The duty in section 81 came into force on 17 January 2025.

Requires providers of information society services likely to be accessed by children in the UK to apply 15 standards of age appropriate design, such as privacy by default, data minimisation, and not using nudge techniques that weaken children's privacy protections, under a statutory code of practice issued by the Information Commissioner under the Data Protection Act 2018.

The code came into force on 2 September 2020 with a 12 month transition period ending 2 September 2021, after which the Commissioner and courts must take it into account when assessing UK GDPR compliance.

Sets out the measures Ofcom expects user-to-user and search services likely to be accessed by children to adopt to comply with the Online Safety Act's children's safety duties, including age assurance, safer default settings and algorithms, and content moderation; providers that follow the Codes are treated as compliant.

Ofcom published the final Codes on 24 April 2025; providers had to complete children's risk assessments by 24 July 2025 and have risk mitigation measures in place from 25 July 2025, after the Codes completed the required Parliamentary process.

Requires providers of user-to-user services and search services likely to be accessed by children in the UK to carry out children's risk assessments and to use proportionate measures, including age verification or age estimation where appropriate, to prevent children encountering primary priority content harmful to children such as pornography, self harm, suicide, and eating disorder content. Sections 11 and 12 came into force on 10 January 2024.

Section 30(1ZA) provides that copyright in a work is not infringed by the use of a quotation from it, whether for criticism or review or otherwise, provided the work has been made available to the public, the use is fair dealing, the extent of the quotation is no more than required for the purpose it is used for, and it carries a sufficient acknowledgement (unless impossible for reasons of practicality or otherwise); a contract term purporting to override this quotation exception is unenforceable.

Section 30(1) separately permits fair dealing with a work for criticism or review, and section 30(2) permits fair dealing with a work, other than a photograph, for the purpose of reporting current events, each subject to a sufficient-acknowledgement requirement.

None of these provisions carries a headline-length or short-extract cap distinct from the fair-dealing and extent-justified tests, and no reported UK decision has applied section 30 specifically to a systematic news aggregator's reproduction of headlines and snippets, as opposed to an individual quoting a published work.