United Kingdom

Sections 111 and 112 of the Crime and Policing Act 2026 give the Secretary of State a power to provide, by regulations, defenses to listed offenses for persons authorized to test technology. Section 111 came into force on 29 June 2026. Section 112 came into force on 29 June 2026. Under section 255(3)(c), sections 108 to 112 come into force at the end of the period of two months beginning with the day on which the Act is passed.

Section 111(1) provides that the Secretary of State may by regulations provide defenses to relevant offenses for persons who are authorized by the Secretary of State to carry out technology testing activities. The section therefore creates no defense by itself, and a defense exists only to the extent that regulations provide one.

Technology testing activities are activities carried out in the course of, or in connection with, testing technology to investigate whether it may have been made or adapted for use for creating, or facilitating the creation of, prohibited material, or to test whether it may be used to create, or facilitate the creation of, prohibited material. Prohibited material is anything in relation to which a relevant offense may be committed.

The regulations may make provision about authorizations, including conditions, variation, suspension and withdrawal, enforcement of breaches of conditions (which may include criminal offenses punishable with a fine) and fees payable to the Secretary of State to recover costs.

The Secretary of State must consult the Scottish Ministers, and the Department of Justice in Northern Ireland, before making regulations containing provision within the legislative competence of the Scottish Parliament or the Northern Ireland Assembly respectively, subject to the limits stated in the section.

Section 112(2) lists as relevant offenses, among others, offenses under section 2 of the Obscene Publications Act 1959 and section 1(1)(a), (b) or (c) of the Protection of Children Act 1978, and in the Sexual Offences Act 2003 the offenses in section 46A, section 66B(1), section 66E(1) and section 66F(1) or (2). Section 112(3) lists the offense in section 52D of the Civic Government (Scotland) Act 1982 among the relevant offenses for Scotland.

Section 112(4) lists the offense in Article 42A of the Sexual Offences (Northern Ireland) Order 2008 among the relevant offenses for Northern Ireland. The Secretary of State may by regulations amend section 112 so as to change the meaning of 'relevant offense'.

A Government supplementary delegated powers memorandum of 12 November 2025, written when the clause was a proposed amendment to the Bill, describes the power as a 'Power to authorise technology such as AI models to be tested for prohibited material, without offences being committed in the course of the testing'.

Section 248 of the Crime and Policing Act 2026 inserts section 216A into the Online Safety Act 2023, and the section came into force at Royal Assent. Section 249, which requires a progress report on regulations under section 216A, also came into force at Royal Assent. Royal Assent was given on 29 April 2026.

Section 216A(1) lets the Secretary of State by regulations amend any provision of the Online Safety Act for or in connection with minimizing or mitigating the risks of harm to individuals in the United Kingdom presented by illegal AI-generated content and by the use of AI services for the commission or facilitation of priority offenses. In section 216A, 'AI' is short for artificial intelligence.

An 'AI service' is an internet service that is capable, or part of which is capable, of generating AI-generated content, no matter what proportion of the content on the service is AI-generated. The regulations may impose on providers of AI services the duties that sections 9 and 10 of the Online Safety Act impose on providers of regulated user-to-user services, and those that sections 26 and 27 impose on providers of regulated search services, or duties corresponding or similar to them.

The regulations may also impose on providers of AI services the fraudulent advertising duties of sections 38 and 39 and the requirement in section 66 to report child sexual exploitation and abuse content, or corresponding or similar requirements. The regulations may confer on Ofcom, in relation to AI services, functions corresponding to its fees, information and enforcement functions, including powers to impose monetary penalties.

The regulations may make provision having the effect that AI services provided from outside the United Kingdom are regulated by the Act. The regulations may not amend section 234 of the Online Safety Act ('harm' etc).

Section 249 requires the Secretary of State to lay before Parliament, no later than 31 December 2026, a report about the progress made towards making regulations under section 216A, unless a draft of a statutory instrument containing regulations under that section is laid before Parliament before that date.

Section 138 of the Data (Use and Access) Act 2025 inserts new sections 66E to 66H into the Sexual Offences Act 2003.

Section 66E makes it an offence for a person intentionally to create a 'purported intimate image' of another adult without that person's consent, and section 66F makes it a separate offence intentionally to request the creation of such an image, or to request that an image include or exclude a particular thing, without consent; the request offence is committed regardless of whether the image is ever created, of whether it is also requested by someone else, and regardless of where in the world the requester or recipient of the request is located.

A 'purported intimate image' is an image that appears to be, or to include, a photograph or film of the person, but is not, or is not only, an actual photograph or film of them, and that appears to show an adult in an intimate state; a reference to an image expressly includes data stored by any means which is capable of conversion into an image, photograph or film.

Modifying an existing photograph or film of a person does not fall within the offence unless it adds an intimate element, or a person, not shown in the original. Both offences carry a defence of reasonable excuse, and the Secretary of State must review the operation of that defence and lay a report before Parliament within two years of commencement. Section 138 came into force on 6 February 2026.

Since 29 June 2026 both offences are also priority offences under Schedule 7 to the Online Safety Act 2023, so a regulated user-to-user service's illegal content duties reach them, including the duty to mitigate the risk of the service being used to commit or facilitate either offence.

Section 99 of the Crime and Policing Act 2026 inserts sections 66I to 66L into the Sexual Offences Act 2003 and came into force on 29 June 2026. A person commits an offense by making or adapting a thing, or supplying or offering to supply a thing, for use as a generator of purported intimate images. A generator of purported intimate images is a thing for creating, or facilitating the creation of, purported intimate images of a person.

A person makes, adapts, supplies or offers to supply a thing for that use if a reasonable person, having regard to all the circumstances, would consider that they do so.

A 'thing' includes a program, information in electronic form and a service, and 'purported intimate image' has the same meaning as in section 66E. It is a defense for the person to prove that they took all reasonable steps to prevent the thing being used for creating, or facilitating the creation of, purported intimate images of a person without the person's consent.

Section 66J adds defenses for acts done for the prevention, detection or investigation of crime or for criminal proceedings anywhere in the world, for members of the Security Service, the Secret Intelligence Service or GCHQ acting for the purposes of a function of that body, and for members, staff and assistants of Ofcom acting for the purposes of its online safety functions.

An internet service provider does not commit the offense by providing access to a communication network, or by transmitting information provided by a user, if it does not initiate the transmission, select the recipient or select or modify the information.

A provider that stores information provided by a user who is not acting under its authority or control is protected if, when the information was provided, it did not know that it was or contained a generator of purported intimate images, and it promptly removed the information or disabled access once it knew. Where a body commits the offense with the consent or connivance of a relevant person, such as a director, manager or secretary, that person also commits it.

On summary conviction the penalty is imprisonment for a term not exceeding the general limit in a magistrates' court or a fine, or both, and on conviction on indictment it is imprisonment for a term not exceeding 3 years or a fine, or both.

Section 72 of the Crime and Policing Act 2026 inserts sections 46A to 46C into the Sexual Offences Act 2003 and was not in force at Royal Assent. Under section 255(1) the Act comes into force, subject to the exceptions in that section, on such day as the Secretary of State appoints by regulations. No regulations appointing the day on which this section comes into force have been located.

A person commits the offense by making or adapting a thing for use for creating, or facilitating the creation of, CSA images, or by possessing, supplying or offering to supply a thing made or adapted for that use. A 'thing' includes a program, information in electronic form and a service.

A 'CSA image' is an indecent photograph or pseudo-photograph of a child within the meaning of the Protection of Children Act 1978, or a prohibited image of a child within the meaning of section 62 of the Coroners and Justice Act 2009 that is not an excluded image within the meaning of section 63 of that Act. The Government's factsheet on the Act says the new offense will 'criminalise AI models that have been optimised to create CSAM'.

The factsheet adds that the offense 'will not criminalise AI developers' and 'is targeted at offenders who optimise AI models specifically to enhance their ability to create child sexual abuse material'. It is a defense to possession for the person to prove that the thing was sent without any request made by or on behalf of the person and that the person did not keep it for an unreasonable time.

It is a defense to possessing, supplying or offering to supply for the person to prove that the person did not know, and did not have cause to suspect, that the thing was a CSA image-generator.

Section 46B adds defenses for acts done for the prevention, detection or investigation of crime or for criminal proceedings anywhere in the world, for members of the Security Service, the Secret Intelligence Service or GCHQ acting for the purposes of a function of that body, and for members, staff and assistants of Ofcom acting for the purposes of its online safety functions.

An internet service provider does not commit the offense by providing access to a communication network, or by transmitting information provided by a user, if it does not initiate the transmission, select the recipient or select or modify the information.

A provider that stores information provided by a user who is not acting under its authority or control is protected if, when the information was provided, it did not know that it was or contained a CSA image-generator, and it promptly removed the information or disabled access once it knew. Where a body commits the offense with the consent or connivance of a relevant person, such as a director, manager or secretary, that person also commits it.

On summary conviction the penalty is imprisonment for a term not exceeding the general limit in a magistrates' court or a fine, or both, and on conviction on indictment it is imprisonment for a term not exceeding 5 years or a fine, or both.

Section 73 of the Crime and Policing Act 2026 inserts Articles 42A to 42C into the Sexual Offences (Northern Ireland) Order 2008 and was not in force at Royal Assent. Under section 255(8)(g), section 73 comes into force, so far as it extends to Northern Ireland, on such day as the Department of Justice in Northern Ireland appoints by order. No order appointing the day on which this section comes into force in Northern Ireland has been located.

A person commits the offense by making or adapting a thing for use for creating, or facilitating the creation of, CSA images, or by possessing, supplying or offering to supply a thing made or adapted for that use. A 'thing' includes a program, information in electronic form and a service.

A 'CSA image' is an indecent photograph or pseudo-photograph of a child within the meaning of the Protection of Children (Northern Ireland) Order 1978, or a prohibited image of a child within the meaning of section 62 of the Coroners and Justice Act 2009 that is not an excluded image within the meaning of section 63 of that Act.

It is a defense to possession for the person to prove that the thing was sent without any request made by or on behalf of the person and that the person did not keep it for an unreasonable time. It is a defense to possessing, supplying or offering to supply for the person to prove that the person did not know, and did not have cause to suspect, that the thing was a CSA image-generator.

Article 42B adds defenses for acts done for the prevention, detection or investigation of crime or for criminal proceedings anywhere in the world, for members of the Security Service, the Secret Intelligence Service or GCHQ acting for the purposes of a function of that body, and for members, staff and assistants of Ofcom acting for the purposes of its online safety functions.

An internet service provider does not commit the offense by providing access to a communication network, or by transmitting information provided by a user, if it does not initiate the transmission, select the recipient or select or modify the information.

A provider that stores information provided by a user who is not acting under its authority or control is protected if, when the information was provided, it did not know that it was or contained a CSA image-generator, and it promptly removed the information or disabled access once it knew. Where a body commits the offense with the consent or connivance of a relevant person, such as a director, manager or secretary, that person also commits it.

On summary conviction the penalty is imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum, or both, and on conviction on indictment it is imprisonment for a term not exceeding 5 years or a fine, or both.

Section 74 of the Crime and Policing Act 2026 inserts sections 52D and 52E into the Civic Government (Scotland) Act 1982 and was not in force at Royal Assent. Under section 255(10)(d), sections 74 and 76 come into force, so far as they extend to Scotland, on such day as the Scottish Ministers appoint by regulations. No regulations appointing the day on which this section comes into force in Scotland have been located.

A person commits the offense by making or adapting a thing for use for creating, or facilitating the creation of, CSA images, or by possessing, supplying or offering to supply a thing made or adapted for that use. A 'thing' includes a program, information in electronic form and a service. A 'CSA image' is an indecent photograph or pseudo-photograph of a child within the meaning of section 52 of the 1982 Act.

It is a defense to possession for the person to prove that the thing was sent without any request made by or on behalf of the person and that the person did not keep it for an unreasonable time. It is a defense to possessing, supplying or offering to supply for the person to prove that the person did not know, and did not have cause to suspect, that the thing was a CSA image-generator.

Section 52E adds defenses for acts done for the prevention, detection or investigation of crime or for criminal proceedings anywhere in the world, for members of the Security Service, the Secret Intelligence Service or GCHQ acting for the purposes of a function of that body, and for members, staff and assistants of Ofcom acting for the purposes of its online safety functions.

An internet service provider does not commit the offense by providing access to a communication network, or by transmitting information provided by a user, if it does not initiate the transmission, select the recipient or select or modify the information.

A provider that stores information provided by a user who is not acting under its authority or control is protected if, when the information was provided, it did not know that it was or contained a CSA image-generator, and it promptly removed the information or disabled access once it knew.

On summary conviction the penalty is imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum, or both, and on conviction on indictment it is imprisonment for a term not exceeding 5 years or a fine, or both.

Section 75 of the Crime and Policing Act 2026 amends section 69 of the Serious Crime Act 2015, the offense of possessing a 'paedophile manual', and was not in force at Royal Assent. Under section 255(1) the Act comes into force, subject to the exceptions in that section, on such day as the Secretary of State appoints by regulations. No regulations appointing the day on which this section comes into force have been located.

Section 69(1) of the 2015 Act makes it an offense to be in possession of any item that contains advice or guidance about abusing children sexually. Section 75 inserts 'or creating CSA images' after 'sexually' in subsections (1) and (2)(b)(ii) of section 69.

The new definition in section 69(2A) of 'abusing children sexually or creating CSA images' covers, in England and Wales, doing anything that constitutes an offense under section 1 of the Protection of Children Act 1978, an offense under Part 1 of the Sexual Offences Act 2003 against a person under 16, or human trafficking committed with a view to sexual exploitation against a person under 16, with equivalent provisions for Northern Ireland, and it also covers 'creating (anywhere) a prohibited image of a child within the meaning of section 62 of the Coroners and Justice Act 2009'.

Section 75(4) omits the existing definition of 'abusing children sexually' from subsection (8) of section 69. That definition covered an offense under section 1 of the Protection of Children Act 1978 involving indecent photographs but not pseudo-photographs. The Government's factsheet on the Act says the amendment will 'cover Artificially Generated (AI) CSAM'.

It is a defense for the person to prove a legitimate reason for being in possession of the item, or that the person had not read, viewed or listened to the item and did not know and had no reason to suspect that it contained such advice or guidance, or that the item was sent without any request and the person did not keep it for an unreasonable time.

The penalty on summary conviction is imprisonment for a term not exceeding the general limit in a magistrates' court (England and Wales) or 6 months (Northern Ireland), or a fine, or both, and on conviction on indictment imprisonment for a term not exceeding 3 years or a fine, or both.

Proceedings may be brought in England and Wales only by or with the consent of the Director of Public Prosecutions, and in Northern Ireland only by or with the consent of the Director of Public Prosecutions for Northern Ireland. Section 69(7) of the 2015 Act provides that Schedule 3 to that Act makes special provision for persons providing information society services.

Section 76 of the Crime and Policing Act 2026 inserts sections 41A and 41B into the Sexual Offences (Scotland) Act 2009 and was not in force at Royal Assent. Under section 255(10)(d), sections 74 and 76 come into force, so far as they extend to Scotland, on such day as the Scottish Ministers appoint by regulations. No regulations appointing the day on which this section comes into force in Scotland have been located.

It is an offense to be in possession of any item that contains advice or guidance about abusing children sexually or creating CSA images.

Abusing children sexually or creating CSA images means doing anything that constitutes an offense under section 52 or 52D of the Civic Government (Scotland) Act 1982, or one of the listed offenses under the Criminal Law (Consolidation) (Scotland) Act 1995, the Protection of Children and Prevention of Sexual Offences (Scotland) Act 2005, the Sexual Offences (Scotland) Act 2009 and the Human Trafficking and Exploitation (Scotland) Act 2015, some of them limited to offenses against a person under 18, or doing anything outside Scotland that would constitute such an offense if done in Scotland.

It is a defense for the person to prove a legitimate reason for being in possession of the item, or that the person had not read, viewed or listened to the item and did not know and had no reason to suspect that it contained such advice or guidance, or that the item was sent without any request and the person did not keep it for an unreasonable time.

The penalty on summary conviction is imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum, or both, and on conviction on indictment imprisonment for a term not exceeding 3 years or a fine, or both. A service provider does not commit the offense by providing access to a communication network, or by transmitting information provided by a user, if it does not initiate the transmission, select the recipient or select or modify the information.

A service provider that stores information provided by a user who is not acting under its authority or control is protected if, when the information was provided, it did not know that it was or contained such advice or guidance, and it promptly removed the information or disabled access once it knew.

Section 80 of the Data (Use and Access) Act 2025 replaces Article 22 of the UK GDPR with Articles 22A to 22D. A decision is based solely on automated processing where there is no meaningful human involvement in taking it, and it is a significant decision where it produces a legal effect for the person or a similarly significant effect.

A significant decision that rests entirely or partly on special category personal data may not be taken solely by automated processing unless the decision is based entirely on processing to which the person has given explicit consent, or the decision is necessary for entering into or performing a contract with the person, or is required or authorised by law, and point (g) of Article 9(2) applies.

Where a controller takes a significant decision based solely on automated processing that uses personal data, it must have safeguards that give the person information about the decision, let them make representations, let them obtain human intervention and let them contest the decision. The Secretary of State may make regulations on what counts as meaningful human involvement and a similarly significant effect, and on further safeguards.

SYSC 6.1.2-AR to SYSC 6.1.3-CR bind a common platform firm. A common platform firm is a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator.

A common platform firm must establish, implement and maintain adequate policies and procedures designed to detect any risk of failure by the firm to comply with its obligations under the UK law on markets in financial instruments, and put in place adequate measures and procedures designed to minimize such risks and to enable the FCA to exercise its powers effectively under that law.

A common platform firm must establish and maintain a permanent and effective compliance function which operates independently. A common platform firm must ensure that the relevant persons involved in its compliance function are not involved in the performance of the services or activities they monitor. SYSC 6.1.3-AR took effect on October 23, 2025.

A contravention of a rule in the common platform requirements does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000.

SYSC Schedule 5 records that the FCA has removed the right of action under section 138D of the Financial Services and Markets Act 2000 for SYSC 4 to SYSC 10A, with a reference to SYSC 1 Annex 1 2.19R. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

The common platform requirements, which include SYSC 6.1, apply to every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless provided otherwise in a specific rule. A firm in the Handbook is an authorized person.

The Glossary brings payment and electronic money institutions within the term only in the modules it names, PRIN 2, PRIN 2A, CTPS and FEES among them, and never in SYSC, so SYSC 6.1 does not bind a payment or electronic money institution that is not an authorized person.

A firm must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm, including its managers, employees and appointed representatives, with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime.

SYSC 6.1.4AR requires a firm that is not a common platform firm or a management company, and that carries on designated investment business with or for retail clients or professional clients, to allocate to a director or senior manager the function of having responsibility for oversight of the firm's compliance and of reporting to the governing body in respect of that responsibility. SYSC 6.1.1R took effect on January 3, 2018. SYSC 6.1.4AR took effect on July 26, 2013.

A contravention of a rule in the common platform requirements does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000.

SYSC Schedule 5 records that the FCA has removed the right of action under section 138D of the Financial Services and Markets Act 2000 for SYSC 4 to SYSC 10A, with a reference to SYSC 1 Annex 1 2.19R. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

Section 157(A1) of the Consumer Credit Act 1974 requires a creditor under a prospective regulated agreement, other than an excluded agreement, that decides not to proceed with it on the basis of information obtained from a credit reference agency to inform the debtor of that when informing the debtor of the decision, and to give the debtor the agency's name, address and telephone number.

Section 157(1) requires a creditor, owner or negotiator, in any other case and within the prescribed period after receiving a request in writing from the debtor or hirer, to give notice of the name and address of any credit reference agency from which it applied for information about the debtor's or hirer's financial standing during the antecedent negotiations. Subsection (1) does not apply to a request received more than 28 days after the termination of the antecedent negotiations.

A creditor is not required to disclose information under section 157 if the disclosure would create or be likely to create a serious risk that any person would be subject to violence or intimidation, or would or would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders or the administration of justice. For the purposes of subsection (A1) an agreement is an excluded agreement if it is a consumer hire agreement or an agreement secured on land.

Section 189 defines a creditor as the person providing credit under a consumer credit agreement, or the person to whom that person's rights and duties under the agreement have passed by assignment or operation of law, and in relation to a prospective consumer credit agreement as including the prospective creditor.

Section 189 defines a regulated agreement as a consumer credit agreement which is a regulated agreement within the meaning of section 8(3), or a consumer hire agreement which is a regulated agreement within the meaning of section 15(2). A creditor, owner or negotiator that fails to comply with subsection (A1) or (1) commits an offence.

Schedule 1 to the Act lists the offence of refusing to give the name and other particulars of a credit reference agency as triable summarily, with a fine at level 4 on the standard scale. Subsection (A1) was inserted with effect from February 1, 2011 by the Consumer Credit (EU Directive) Regulations 2010. The opening words of subsection (1), 'In any other case', were inserted with effect from February 1, 2011 by the same Regulations.

Section 158 requires a credit reference agency, within the prescribed period after receiving a consumer's written request, the particulars it may reasonably require to identify the file and a fee of £2, to give the consumer a copy of the file it keeps.

Section 159 lets an individual who has been given information by a credit reference agency under Article 15(1) to (3) of the UK GDPR or under section 158, and who considers that an entry in the file is incorrect and that the individual is likely to be prejudiced if it is not corrected, give notice to the agency requiring it to remove or amend the entry. Section 161(1)(b) gives the local weights and measures authority in Great Britain a duty to enforce the Act and regulations made under it.

Section 161(1A) leaves any function of the Financial Conduct Authority in relation to enforcement of the Act unaffected.

Section 29(1) of the Equality Act 2010 says that a person (a service-provider) concerned with the provision of a service to the public or a section of the public (for payment or not) must not discriminate against a person requiring the service by not providing the person with the service.

A service-provider must not, in providing the service, discriminate against a person as to the terms on which it provides the service, by terminating the provision of the service, or by subjecting the person to any other detriment. A service-provider must not, in relation to the provision of the service, harass a person requiring the service or a person to whom it provides the service.

A service-provider must not victimise a person requiring the service by not providing the person with the service. A person must not, in the exercise of a public function that is not the provision of a service to the public or a section of the public, do anything that constitutes discrimination, harassment or victimisation. A reference to the provision of a service includes the provision of goods or facilities.

A reference to a service-provider not providing a person with a service includes not providing it of the quality, or in the manner or on the terms, that the service-provider usually provides to the public or the section of it that includes the person. A reference to a person requiring a service includes a person who is seeking to obtain or use the service.

Section 19(1) says that a person (A) discriminates against another (B) if A applies to B a provision, criterion or practice which is discriminatory in relation to a relevant protected characteristic of B's. A provision, criterion or practice is discriminatory in that sense if A applies or would apply it to persons with whom B does not share the characteristic, it puts or would put persons with whom B shares the characteristic at a particular disadvantage when compared with persons with whom B does not share it, it puts or would put B at that disadvantage, and A cannot show it to be a proportionate means of achieving a legitimate aim.

The relevant protected characteristics for section 19 are age; disability; gender reassignment; marriage and civil partnership; race; religion or belief; sex; sexual orientation. Section 4 lists the protected characteristics as age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; sex; sexual orientation.

Schedule 3 to the Act, in its Part 5 on insurance and other financial services, provides that a person does not contravene section 29, so far as relating to age discrimination, by doing anything in connection with the provision of a financial service. For that exception a financial service includes a service of a banking, credit, insurance, personal pension, investment or payment nature.

Where the person conducts an assessment of risk for the purposes of providing the financial service to another person, the person may rely on the exception only if the assessment, so far as it involves a consideration of that person's age, is carried out by reference to information which is relevant to the assessment of risk and from a source on which it is reasonable to rely. Paragraph 20A was inserted with effect from October 1, 2012 by the Equality Act 2010 (Age Exceptions) Order 2012.

It is not a contravention of section 29, so far as relating to disability discrimination, to do anything in connection with insurance business if the conditions in paragraph 21(1) are met. Those conditions are that the thing is done by reference to information that is both relevant to the assessment of the risk to be insured and from a source on which it is reasonable to rely, and that it is reasonable to do that thing.

It is not a contravention of section 29, so far as relating to relevant discrimination as paragraph 23 defines it, to do anything in connection with insurance business in relation to an existing insurance policy. An existing insurance policy is a policy of insurance entered into before the date on which paragraph 23 comes into force.

That exception does not apply where the existing insurance policy was renewed, or the terms of the policy were reviewed, on or after the date on which the paragraph came into force. Section 29 does not apply to the provision of a relevant financial service if the provision is in pursuance of arrangements made by an employer for the service-provider to provide it to the employer's employees and other persons as a consequence of the employment.

A relevant financial service for that purpose is insurance or a related financial service, or a service relating to membership of or benefits under a personal pension scheme. Paragraph 22 of Schedule 3 was omitted with effect from December 21, 2012. The county court in England and Wales, or the sheriff in Scotland, has jurisdiction to determine a claim relating to a contravention of Part 3. That jurisdiction under section 114(1)(a) does not extend to a claim within section 115.

The county court has power to grant any remedy which could be granted by the High Court in proceedings in tort or on a claim for judicial review. An award of damages may include compensation for injured feelings. Where a contravention is established by virtue of section 19 and the provision, criterion or practice was not applied with the intention of discriminating against the claimant, the court must not make an award of damages unless it first considers whether to make any other disposal.

Sections 4 and 19 of the Act came into force on October 1, 2010. Section 29 was wholly in force on October 1, 2012, having come into force for certain purposes on October 1, 2010.

The commencement order of 2010 brought the provisions of Part 3 into force on October 1, 2010 except so far as they apply to the protected characteristic of age, and except paragraph 2 of Schedule 2 so far as it relates to the third requirement where the person subject to the duty is a local authority or education authority exercising certain education functions.

Only sections 82, 105(3) and (4) and 199 of the Equality Act 2010 form part of the law of Northern Ireland, so the Act's provisions on services do not extend there.

Section 20 of the Equality Act 2010 applies where the Act imposes a duty to make reasonable adjustments on a person, together with sections 21 and 22 and the applicable Schedule. For Part 3 (services and public functions) the applicable Schedule is Schedule 2. Section 29(7) applies a duty to make reasonable adjustments to a service-provider and to a person who exercises a public function that is not the provision of a service to the public or a section of the public.

The first requirement is, where a provision, criterion or practice of the person's puts a disabled person at a substantial disadvantage in relation to a relevant matter in comparison with persons who are not disabled, to take such steps as it is reasonable to have to take to avoid the disadvantage. The second requirement is the same duty where a physical feature puts a disabled person at a substantial disadvantage.

The third requirement is, where a disabled person would, but for the provision of an auxiliary aid, be put at a substantial disadvantage, to take such steps as it is reasonable to have to take to provide the auxiliary aid. An auxiliary aid includes an auxiliary service. Where the first or third requirement relates to the provision of information, the steps which it is reasonable to have to take include steps for ensuring that the information is provided in an accessible format.

The person subject to the duty is not, subject to express provision to the contrary, entitled to require a disabled person to pay to any extent the costs of complying with it. Under Schedule 2 a service-provider must comply with the first, second and third requirements. For that purpose the reference in section 20(3), (4) or (5) to a disabled person is to disabled persons generally.

In relation to each requirement the relevant matter is the provision of the service, or the exercise of the function, by the person subject to the duty. For the second requirement, the steps may be to avoid the disadvantage or to adopt a reasonable alternative method of providing the service or exercising the function. Nothing in the paragraph requires a service-provider to take a step which would fundamentally alter the nature of the service or the nature of its trade or profession.

A failure to comply with the first, second or third requirement is a failure to comply with a duty to make reasonable adjustments. A person discriminates against a disabled person if the person fails to comply with that duty in relation to that disabled person. The county court in England and Wales, or the sheriff in Scotland, has jurisdiction to determine a claim relating to a contravention of Part 3. That jurisdiction under section 114(1)(a) does not extend to a claim within section 115.

Sections 15 to 21 of the Act, which include section 20, came into force on October 1, 2010. Paragraph 2 of Schedule 2 was wholly in force on September 1, 2012, having come into force for certain purposes on October 1, 2010. Only sections 82, 105(3) and (4) and 199 of the Equality Act 2010 form part of the law of Northern Ireland, so the Act's provisions on services do not extend there.

CONC 5.2A applies to a firm with respect to consumer credit lending, subject to the exclusions in CONC 5.2A.2R. CONC 5.2A does not apply to an agreement under which a firm takes an article in pawn where the customer's total financial liability is not capable of exceeding the true market value of the article and the passing of property in it to the firm, or its sale, would at the very least discharge the debt secured by the pawn and any other obligation to pay a sum of money under the agreement.

CONC 5.2A does not apply to a current account agreement where the account-holder may be allowed to overdraw without a pre-arranged overdraft or to exceed a pre-arranged overdraft limit and doing so would be a regulated credit agreement (overrunning). CONC 5.2A does not apply to a non-commercial agreement or to a small borrower-lender-supplier agreement which is a restricted-use credit agreement.

CONC 5.2A.4R requires a firm to undertake a reasonable assessment of the creditworthiness of a customer before entering into a regulated credit agreement, significantly increasing the amount of credit provided under one, or significantly increasing a credit limit for running-account credit under one.

The firm must not take any of those steps unless it can demonstrate that it has undertaken the creditworthiness assessment and, where relevant, the assessment of a guarantor in accordance with the rules in the section, and had proper regard to the outcome of the assessment in respect of affordability risk.

A firm must base its creditworthiness assessment on sufficient information that it is aware of at the time, obtained where appropriate from the customer and where necessary from a credit reference agency, and the information must enable the firm to carry out a reasonable assessment.

The firm must consider the risk that the customer will not make repayments by their due dates, which is credit risk, and the risk to the customer of not being able to make repayments, which the section calls affordability risk.

The firm must consider the customer's ability to make repayments without having to borrow to meet them, without failing to make any other payment the customer has a contractual or statutory obligation to make, and without a significant adverse impact on the customer's financial situation.

Unless the firm can demonstrate that it is obvious in the circumstances of the case that the customer is able to make repayments, so as to make the steps disproportionate, or the customer has indicated clearly an intention to repay wholly using savings or other assets, the firm must take reasonable steps to determine, or make a reasonable estimate of, the customer's current income.

CONC 5.2A.17R applies the same duty to the customer's current non-discretionary expenditure where CONC 5.2A.15R also applies, unless the firm can demonstrate that it is obvious that the expenditure is unlikely to have a material impact on affordability risk.

CONC 5.2A.19G says that, in considering non-discretionary expenditure, a firm may take into account statistical data unless it knows or has reasonable cause to suspect that the expenditure is significantly higher than the data describe or that the data are unlikely to be reasonably representative of the customer's situation.

The extent and scope of the assessment, and the steps the firm must take to satisfy the requirement that the assessment is a reasonable one based on sufficient information, are dependent upon, and proportionate to, the individual circumstances of each case. A firm must establish, implement and maintain clear and effective policies and procedures to enable it to carry out creditworthiness assessments and setting out the principal factors it will take into account.

A firm must assess and periodically review the effectiveness of those policies and procedures and its compliance with them and with CONC 5.2A. A firm must maintain a record of each transaction where a regulated credit agreement is entered into, or credit is significantly increased, sufficient to demonstrate that a reasonable creditworthiness assessment was carried out and so to enable the FCA to monitor the firm's compliance.

A firm must not accept an application for credit under a regulated credit agreement where it knows or has reasonable cause to suspect that the customer has not been truthful in completing the application in relation to information relevant to the creditworthiness assessment.

The Consumer Credit (Creditworthiness) Instrument 2018 was made in the exercise of powers in the Financial Services and Markets Act 2000 that include the FCA's general rules power in section 137A, its general supplementary powers in section 137T and its power to give guidance in section 139A. Section 204A of that Act defines a relevant requirement as including a requirement imposed by or under the Act.

The FCA is the appropriate regulator, under section 204A(6), for a contravention of any other requirement imposed by or under the Act, that is, one not dealt with in the earlier subsections of the section. Section 206 of that Act lets the regulator, where it considers that an authorised person has contravened a relevant requirement imposed on the person, impose a penalty in respect of the contravention of such amount as it considers appropriate.

Under section 138E(1) of the Financial Services and Markets Act 2000 a person is not guilty of an offence by reason of a contravention of a rule made by either regulator. Under section 138D(2) of the Financial Services and Markets Act 2000 a contravention by an authorised person of a rule made by the FCA is actionable at the suit of a private person who suffers loss as a result of the contravention, subject to the defences and other incidents applying to actions for breach of statutory duty.

The table in CONC Schedule 5 lists all rules in CONC other than the clear, fair and not misleading rule in CONC 3.3.1R and the prudential rules in CONC 10, a group that includes CONC 5.2A, as rules for which a private person has a right of action under section 138D, with no right of action removed. CONC 5.2A was last updated on November 4, 2024.

Fundamental Rule 5 in the Fundamental Rules Part of the PRA Rulebook requires a firm to have effective risk strategies and risk management systems. The Part applies to all firms unless otherwise stated. The Fundamental Rules apply with respect to the carrying on of regulated activities, dealing in investments as principal and ancillary activities in relation to PRA-regulated activities. Fundamental Rule 5 also applies to unregulated activities, but only in a prudential context.

The Fundamental Rules apply with respect to activities wherever they are carried on. The Prudential Regulation Authority made the Part in the exercise of section 137G of the Financial Services and Markets Act 2000. The instrument that made the Part came into force on June 19, 2014. Section 137G of the Financial Services and Markets Act 2000 lets the PRA make rules applying to PRA-authorised persons.

Section 206 of the Financial Services and Markets Act 2000 lets the appropriate regulator impose on an authorised person that has contravened a relevant requirement a penalty of such amount as it considers appropriate. The PRA is the appropriate regulator for a contravention of a requirement that is imposed under any provision of that Act by the PRA.

Section 138D of the Financial Services and Markets Act 2000 provides that a rule made by the PRA may provide that its contravention is actionable at the suit of a private person who suffers loss. Section 138E of the Financial Services and Markets Act 2000 provides that a person is not guilty of an offence by reason of a contravention of a rule made by either regulator.

A firm must have robust governance arrangements, which include effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and effective control and safeguard arrangements for information processing systems. The common platform requirements, which include SYSC 4.1, apply to every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless provided otherwise in a specific rule. A firm in the Handbook is an authorized person.

The Glossary brings payment and electronic money institutions within the term only in the modules it names, PRIN 2, PRIN 2A, CTPS and FEES among them, and never in SYSC, so SYSC 4.1 does not bind a payment or electronic money institution that is not an authorized person. The current text of SYSC 4.1.1R took effect on January 3, 2018.

The Financial Conduct Authority's AI Update cites SYSC 4.1.1R as a provision relevant to the governance and accountability arrangements of a firm using AI safely and responsibly. A contravention of a rule in the common platform requirements does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000.

If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

SYSC 8.1.1R requires a common platform firm that relies on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services on a continuous and satisfactory basis to take reasonable steps to avoid undue additional operational risk. A common platform firm is a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator.

For a common platform firm, SYSC 8.1.4AR regards an operational function as critical or important if a defect or failure in its performance would materially impair the continuing compliance of the firm with the conditions and obligations of its authorization or its other obligations under the UK law on markets in financial instruments, or its financial performance, or the soundness or the continuity of its designated investment business.

SYSC 8.1.8R requires a common platform firm to take the necessary steps to ensure that the service provider has the ability, capacity, appropriate organizational structure and any authorization required by law to perform the outsourced functions reliably and professionally, among the other conditions it lists.

For SYSC 8, outsourcing means an arrangement of any form between a firm and a service provider by which that service provider performs a process, a service or an activity which would otherwise be undertaken by the firm itself. Because that definition covers an arrangement of any form, a firm's use of a third party's model or AI service that performs a process, a service or an activity the firm would otherwise undertake itself is outsourcing for SYSC 8. SYSC 8.1.1R took effect on January 3, 2018.

SYSC 8.1.8R took effect on October 23, 2025. A contravention of a rule in the common platform requirements does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000.

SYSC Schedule 5 records that the FCA has removed the right of action under section 138D of the Financial Services and Markets Act 2000 for SYSC 4 to SYSC 10A, with a reference to SYSC 1 Annex 1 2.19R. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

SYSC 8.1.6R requires a firm other than a common platform firm that outsources critical or important operational functions or any relevant services and activities to remain fully responsible for discharging all of its obligations under the regulatory system, and to see that the outsourcing does not result in the delegation by senior personnel of their responsibility, does not alter the firm's relationship and obligations towards its clients, does not undermine the conditions with which it must comply in order to be authorized and to remain so, and does not remove or modify any other condition subject to which its authorization was granted.

Other firms should take account of the outsourcing rule in SYSC 8.1.1R as if it were guidance, as SYSC 1 Annex 1 3.3R(1) explains. SYSC 1 Annex 1 3.2ER takes insurers, UK ISPVs, managing agents, the Society, full-scope UK AIFMs of unauthorized AIFs, MiFID optional exemption firms and third country firms out of SYSC 1 Annex 1 3.3R. A firm in the Handbook is an authorized person.

The Glossary brings payment and electronic money institutions within the term only in the modules it names, PRIN 2, PRIN 2A, CTPS and FEES among them, and never in SYSC, so SYSC 8.1.6R does not bind a payment or electronic money institution that is not an authorized person.

For SYSC 8, outsourcing means an arrangement of any form between a firm and a service provider by which that service provider performs a process, a service or an activity which would otherwise be undertaken by the firm itself. Because that definition covers an arrangement of any form, a firm's use of a third party's model or AI service that performs a process, a service or an activity the firm would otherwise undertake itself is outsourcing for SYSC 8.

SYSC 8.1.6R took effect on October 23, 2025. A contravention of a rule in the common platform requirements does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000.

SYSC Schedule 5 records that the FCA has removed the right of action under section 138D of the Financial Services and Markets Act 2000 for SYSC 4 to SYSC 10A, with a reference to SYSC 1 Annex 1 2.19R. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

COBS 9A applies to a firm which provides investment advice or portfolio management in the course of MiFID, equivalent third country or optional exemption business, or investment advice in relation to an insurance-based investment product.

The rules in COBS 9A do not apply to a firm in relation to the provision of a targeted support service within the scope of the rules in COBS 9B. COBS 9A.2.1R requires a firm providing investment advice or portfolio management to obtain the necessary information about the client's knowledge and experience, financial situation and investment objectives, and to recommend or decide to trade only what is suitable for the client.

A firm that provides investment advice or portfolio management services, in whole or in part, through an automated or semi-automated system remains responsible for the suitability assessment, and that obligation is not affected by the use of an electronic system in making the personal recommendation or decision to trade. The rule on automated or semi-automated systems, COBS 9A.2.23R, took effect on October 23, 2025.

COBS 9A.2.23R derives from the second paragraph of article 54(1) of the MiFID Org Regulation. Article 54 of Commission Delegated Regulation (EU) 2017/565 no longer has effect, the Regulation having been revoked on October 23, 2025 in so far as not already in force. The only rules in COBS 9A that apply to a firm providing investment advice in relation to an insurance-based investment product are those which implemented the IDD and those derived from the IDD Regulation.

The Conduct, Perimeter Guidance and Miscellaneous Provisions (MiFID 2) Instrument 2017 inserted COBS 9A as a new chapter. The Conduct, Perimeter Guidance and Miscellaneous Provisions (MiFID 2) Instrument 2017 came into force on January 3, 2018, save for the provisions it lists. The current text of COBS 9A.2.1R took effect on October 1, 2018.

COBS Schedule 5 states that a contravention of any rule in COBS that its table does not list separately may be actionable by a private person under section 138D of the Financial Services and Markets Act 2000. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

COBS 9 applies to a firm which makes a personal recommendation to a retail client in relation to a designated investment, manages investments of a retail client of the firm, or manages the assets of an occupational pension scheme, stakeholder pension scheme or personal pension scheme, other than in relation to its MiFID, equivalent third country or optional exemption business or to an insurance-based investment product.

COBS 9A contains the suitability requirements which apply in respect of insurance-based investment products, or in respect of a firm's MiFID, equivalent third country or optional exemption business involving the provision of investment advice or portfolio management.

The rules in COBS 9 do not apply to a firm in relation to the provision of a targeted support service within the scope of the rules in COBS 9B. A firm must take reasonable steps to ensure that a personal recommendation, or a decision to trade, is suitable for its client. The current text of COBS 9.2.1R took effect on October 1, 2018. The current text of COBS 9.2.2R, which sets the information a firm must obtain from the client, took effect on January 3, 2018.

If a firm does not obtain the necessary information to assess suitability, it must not make a personal recommendation to the client or take a decision to trade for the client. COBS Schedule 5 states that a contravention of any rule in COBS that its table does not list separately may be actionable by a private person under section 138D of the Financial Services and Markets Act 2000.

If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

Principle 12, the Consumer Duty, requires a firm to act to deliver good outcomes for retail customers. The Consumer Duty applies to a firm's retail market business, including in respect of existing products and closed products.

The Consumer Duty Instrument 2022 defined retail market business as the regulated activities and ancillary activities, payment services, issuing electronic money and connected activities of a firm in a distribution chain which involves a retail customer, but not including listed activities. The Consumer Duty applies to the communication or approval of a financial promotion only if the promotion is addressed to, or disseminated in such a way that it is likely to be received by, a retail customer.

Where the Consumer Duty applies to a firm operating in a distribution chain, it applies only to the extent that the firm is responsible, in the course of carrying out those activities, for determining or materially influencing retail customer outcomes. The Consumer Duty does not apply to activities to the extent that they are not included in a rule which sets out the scope of protections offered to retail customers by COBS, ICOBS, MCOB, BCOBS, CMCOB, FPCOB, PROD or CONC.

Principles 6 and 7 do not apply to a firm's activities to the extent that the Consumer Duty applies. The Consumer Duty Instrument 2022 comes into force on July 31, 2023. Except to the extent specified in the transitional provisions for closed product reviews and for sales of closed product books, Principle 12 and PRIN 2A apply to a closed product only from July 31, 2024.

A contravention of the rules in PRIN does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

The Competition and Markets Authority gave notice under section 19(1) of the Digital Markets, Competition and Consumers Act 2024 that it was imposing a conduct requirement, the Publisher Conduct Requirement, on Google relating to its general search services. The Notice is dated 3 June 2026. Google must provide publishers with effective controls to withhold their Search Content from being used in generative AI services and features.

Those controls must cover the training and grounding of Google's broader generative AI services and of its search generative AI features. For the grounding of search generative AI features, the controls must let publishers withhold their Search Content at directory level and at page level. Google must not attempt to circumvent a publisher's choice to withhold its Search Content by acquiring that Search Content through other sources.

Google must publish Explanatory Information on how Search Content is used for the training and grounding of its generative AI services and features, and on the effect and scope of the controls. Google must provide publishers with clear and detailed metrics on user engagement with their Search Content where it is used in its search generative AI features.

Google must take reasonable steps to ensure that Search Content in search generative AI features is attributed clearly and accurately, and that end users are provided with a clear means to access that Search Content. Google must not seek to prevent publishers from, or penalise them for, using the controls, for example by downranking their Search Content.

The obligations apply in relation to the outputs of all generative AI services and features shown to any natural or legal persons located in the UK. The Publisher Conduct Requirement comes into force six months after the date of the Notice, with the exception of paragraph 4.b, which comes into force nine months after the date of the Notice.

Section 29A lets a person with lawful access to a copyright work make a copy of it in order to carry out a computational analysis of anything recorded in the work, for the sole purpose of research for a non-commercial purpose, provided the copy carries a sufficient acknowledgement where practicable. Transferring the copy to another person, or using it for any other purpose, without the copyright owner's authority infringes copyright, and a copy later sold or let for hire is an infringing copy.

The exception covers only analysis for the sole purpose of research for a non-commercial purpose, and a contract term that purports to prevent or restrict a copy the section permits is unenforceable.

UK GDPR Articles 33 and 34 retain the same 72-hour and without-undue-delay structure as EU GDPR, with no threshold for how serious a breach must be before it is notifiable. The DUA Act lengthened the separate PECR breach-notification window for telecoms and ISP-type breaches from 24 hours to 72 hours where feasible, in force 20 August 2025, aligning it with the UK GDPR timeline.

From 5 February 2026 it also raised the maximum penalty for most PECR contraventions to GBP 17.5 million or 4 percent of worldwide turnover, up from GBP 500,000, but a failure to notify a PECR breach under regulation 5A is excluded from that penalty-notice power.

Regulation 2(2) of the Data Protection (Charges and Information) Regulations 2018 requires a data controller to pay a charge to the Information Commission within the first 21 days of each charge period. Regulation 2(3) requires a data controller to give the Information Commission its name and address, a staff-number band and whether it is a public authority. The charge is £52 for a micro organisation, £78 for a small or medium organisation and £3,763 for a large organisation.

Subject to regulation 3(3), a controller is in tier 1 if it has a turnover of £632,000 or less, ten or fewer members of staff, is a charity or is a small occupational pension scheme. Payment by direct debit reduces the applicable charge by £5.00. A data controller need not comply with regulation 2 if all of the processing of personal data it undertakes is exempt processing. Processing undertaken for the purposes of a person's personal, family or household affairs is exempt processing.

These Regulations bind the Crown. Section 158 of the Data Protection Act 2018 caps a fixed penalty for failing to comply with the charges regulations at 150% of the highest charge payable.

The UK retained a copy of the General Data Protection Regulation (GDPR) at Brexit (UK GDPR) alongside the Data Protection Act 2018 (DPA 2018), but that copy has now materially diverged: the Data (Use and Access) Act 2025 (DUA Act, Royal Assent 19 June 2025), whose main data protection reforms took effect 5 February 2026, added a new closed-list "recognised legitimate interests" lawful basis (Article 6(1)(ea)) needing no balancing test, whose Annex 1 conditions cover disclosure for a public-task purpose under Article 6(1)(e), national security, public security and defence, emergencies, detecting, investigating or preventing crime, and safeguarding a vulnerable individual.

Direct marketing and intra-group administrative sharing remain examples of the pre-existing Article 6(1)(f) legitimate-interests basis, not purposes of the new closed list. This basis is unavailable to a public authority exercising its own core functions, and has no equivalent in the EU GDPR Article 6 list.

The European Commission's own adequacy decisions for the UK were renewed 18 December 2025 and now run to 27 December 2031. For UK-outbound transfers, the International Data Transfer Agreement (IDTA) and the IDTA Addendum, both issued by the ICO, are standard data protection clauses a transfer can rely on as its appropriate safeguard where no UK adequacy regulation covers the destination. The Information Commission took over the Information Commissioner's functions on 30 September 2026.

The DUA Act restructured UK GDPR's transfer chapter: the original Article 44 was omitted and replaced from 5 February 2026 by a new Article 44A, which requires that a transfer either be approved by regulations, made subject to appropriate safeguards, or made in reliance on a derogation for specific situations, the same three-track adequacy, safeguards, or derogation structure as EU GDPR Chapter V, run through the UK's own instruments rather than the EU's. This is a real, structured condition on outbound transfer, not an absence of restriction.

Before the DUA Act, UK GDPR Article 22, inherited unchanged from EU GDPR, generally prohibited a decision based solely on automated processing that produces legal or similarly significant effects, subject to narrow exceptions.

Section 80 of the DUA Act replaced Article 22 with four new articles, 22A to 22D, in force from 5 February 2026: a significant decision based solely on automated processing of personal data is now generally permitted, provided the controller has safeguards in place that give the individual information about such decisions taken about them and let them make representations, obtain human intervention, and contest the decision.

Restrictions remain in two cases: a decision based entirely or partly on special category data needs the individual's explicit consent, or must be necessary for a contract or required or authorised by law with the Article 9(2)(g) substantial public interest condition met, and no such decision may be taken where the processing relies entirely or partly on the new recognised legitimate interests basis.

A related statutory duty, S.I. 2026/425 (made 16 April 2026, in force 12 May 2026), requires the Information Commissioner to prepare a code of practice giving guidance on good practice in developing and using AI and in automated decision-making, including for children's personal data. Under section 127 of the Data Protection Act 2018 a court or tribunal must take such a code into account where it is relevant, but failing to follow it does not of itself make a person liable.

The ICO's own non-binding draft guidance was under public consultation from 31 March to 29 May 2026. The Information Commission took over the Information Commissioner's functions on 30 September 2026. That still-unmade Code is recorded on this same row rather than as a separate instrument, since it exists specifically to implement this reform and does not yet have content of its own to describe.

UK GDPR's own definition of 'controller', now at Article 4(1)(7) following the DUA Act's renumbering of Article 4, names a public authority, agency or other body on the same footing as a natural or legal person, so these Articles 22A to 22D automated decision-making duties bind a government body exactly as they bind a private one.

UK GDPR Article 15 gives a data subject the right to obtain from the controller confirmation of whether their personal data are being processed and, where they are, access to the data. Article 15(1A), inserted by the Data (Use and Access) Act 2025, limits what a data subject is entitled to under Article 15(1) to what the controller can provide based on a reasonable and proportionate search.

Article 16 gives a data subject the right to have the controller rectify inaccurate personal data concerning them without undue delay. Article 17 gives a data subject the right to have the controller erase their personal data without undue delay where the data are no longer necessary for the purposes for which they were collected or otherwise processed, among other grounds.

Article 17(3) disapplies the erasure right to the extent that processing is necessary for exercising the right of freedom of expression and information, among other listed cases. Article 18 gives a data subject the right to obtain restriction of processing where the accuracy of the personal data is contested by the data subject, among other cases.

Article 20 gives a data subject the right to receive the personal data they have provided to a controller in a structured, commonly used and machine-readable format, where the processing rests on consent or a contract and is carried out by automated means. Article 21(1) lets a data subject object, on grounds relating to their particular situation, to processing based on point (e), (ea) or (f) of Article 6(1), and the controller must then stop unless it demonstrates compelling legitimate grounds.

Article 21 also gives a data subject the right to object at any time to processing of their personal data for direct marketing, after which the personal data may no longer be processed for that purpose. Article 12A defines the applicable time period under Article 12 as the period of one month beginning with the relevant time. A controller may extend the applicable time period under Article 12A by two further months by giving notice, where the complexity or number of requests makes it necessary.

Article 12A was inserted into the UK GDPR with effect from 5 February 2026. Under Article 12(5) a controller may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, and bears the burden of demonstrating that. Section 164A of the Data Protection Act 2018 requires a controller that receives a data subject's complaint to acknowledge it within 30 days and then to respond to it without undue delay.

Section 164A was inserted by the Data (Use and Access) Act 2025 and has been in force in full since 19 June 2026. Article 4(1)(7) defines a controller as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

The Information Commission is the UK's single supervisory authority, unlike Germany's 17-authority structure, with UK GDPR Article 83 fines up to the greater of GBP 17.5 million or 4 percent of global turnover. The Information Commission took over the Information Commissioner's functions on 30 September 2026.

Section 169 DPA 2018 supplies a private right of action for contravention of data protection legislation other than UK GDPR itself, while UK GDPR's own Article 82 covers contraventions of the Regulation directly; both cover material and non-material damage.

The UK's own Supreme Court has gone further than the CJEU in limiting what counts: Lloyd v Google LLC [2021] UKSC 50 (10 November 2021) unanimously rejected a representative claim brought on behalf of millions of iPhone users, holding that compensation under section 13 of the Data Protection Act 1998 for a non-trivial data protection breach requires the individual to show material damage or distress, not a bare loss of control alone, and that such a claim cannot succeed without showing unlawful use and resulting damage for each individual claimant rather than the group as a whole.

Biometric data used for identification, fingerprints, facial templates, voiceprints, is special category data under UK GDPR Article 9, the same definition as EU GDPR.

The DPA 2018's Schedule 1 supplies the UK's own list of Article 9(2)(g) substantial public interest conditions, 23 conditions in Part 2 of Schedule 1, in addition to explicit consent, employment and social-security processing authorised by law, vital interests, not-for-profit bodies, data manifestly made public, legal claims, health and social care, public health, and archiving and research.

The ICO's own "Biometric recognition" guidance, published in final form 5 March 2024, states that biometric data becomes special category personal data from the moment of collection once a purpose of unique identification has been determined for it.

The Data (Use and Access) Act 2025 inserted a new Article 11A UK GDPR giving the Secretary of State a ministerial power to expand, by regulation, what description of processing is subject to Article 9's prohibition or its exceptions; no such regulation had been made as of the date shown. The ICO fined Clearview AI Inc GBP 7,552,800 for, among other findings, failing to meet the higher data protection standard biometric data requires.

In October 2025, the Upper Tribunal held that the First-tier Tribunal had wrongly found Clearview's processing outside UK GDPR's material scope, restoring the ICO's jurisdiction to have issued the fine and enforcement notice and remitting the substantive appeal against them to the First-tier Tribunal for determination. The Information Commission took over the Information Commissioner's functions on 30 September 2026.

Section 1 makes it an offence for a person to cause a computer to perform any function with intent to secure access to a program or data, where that access is unauthorised and the person knows it is unauthorised. Section 17(5) defines access as unauthorised if the person is not themselves entitled to control access of that kind and does not have consent from someone who is; section 17(8) applies the same test, in materially the same words, to an act done in relation to a computer more generally.

Neither definition conditions unauthorised access on defeating a technical security measure. No reported UK case has been located establishing how section 1 applies to the automated collection of content from a public, unauthenticated website that imposes no access control. The sections this entry groups came into force on different days.

Section 296ZA of the Copyright, Designs and Patents Act 1988 applies where effective technological measures have been applied to a copyright work other than a computer program and a person does anything which circumvents those measures knowing, or with reasonable grounds to know, that he is pursuing that objective.

Section 296ZF defines technological measures as any technology, device or component which is designed, in the normal course of its operation, to protect a copyright work other than a computer program. Such measures are effective if the copyright owner controls the use of the work through an access control or protection process such as encryption, scrambling or other transformation of the work, or through a copy control mechanism, which achieves the intended protection.

The person issuing copies of the work to the public or communicating it to the public, and the copyright owner or exclusive licensee, have the same rights against the person who circumvents the measures as a copyright owner has in respect of an infringement of copyright.

Section 296ZA does not apply where a person circumvents effective technological measures for the purposes of research into cryptography, unless in doing so, or in issuing information derived from that research, he affects prejudicially the rights of the copyright owner.

Section 296ZB makes it an offence to manufacture for sale or hire, to import otherwise than for private and domestic use, to sell, let for hire, offer, advertise, possess or distribute in the course of a business, or to distribute otherwise than in the course of a business to such an extent as to affect prejudicially the copyright owner, a device, product or component which is primarily designed, produced or adapted for the purpose of enabling or facilitating the circumvention of effective technological measures.

It is also an offence to provide, promote, advertise or market a service the purpose of which is to enable or facilitate that circumvention, in the course of a business or, otherwise than in the course of a business, to such an extent as to affect prejudicially the copyright owner.

A person guilty of either offence is liable on summary conviction to imprisonment for a term not exceeding three months, or to a fine not exceeding the statutory maximum, or both, and on conviction on indictment to a fine or imprisonment for a term not exceeding two years, or both.

It is a defence for the defendant to prove that he did not know, and had no reasonable ground for believing, that the device, product, component or service enabled or facilitated the circumvention of effective technological measures.

Section 296ZD gives the person issuing or communicating the work to the public, the copyright owner or exclusive licensee, and the owner or exclusive licensee of any intellectual property right in the effective technological measures the same rights as a copyright owner has in respect of an infringement of copyright against a person who deals in circumvention devices, products or components or provides circumvention services.

Section 296ZE lets a person who is prevented by an effective technological measure from carrying out a permitted act issue a notice of complaint to the Secretary of State, who may then give directions to the copyright owner or exclusive licensee. Subject to subsection (9A), that remedy does not apply to copyright works made available to the public on agreed contractual terms in such a way that members of the public may access them from a place and at a time individually chosen by them.

Sections 296 to 296ZF were substituted for the former section 296 with effect from 31 October 2003 by regulation 24(1) of the Copyright and Related Rights Regulations 2003.

Section 22 of the Copyright, Designs and Patents Act 1988 makes it an infringement of copyright to import into the United Kingdom, without the copyright owner's licence and otherwise than for private and domestic use, an article that the importer knows or has reason to believe is an infringing copy of the work.

Section 23 makes it an infringement, without the copyright owner's licence and with the same knowledge or reason to believe, to possess an infringing copy in the course of a business, to sell or let it for hire or offer or expose it for sale or hire, to exhibit it in public or distribute it in the course of a business, or to distribute it otherwise than in the course of a business to such an extent as to affect the owner prejudicially.

Section 27 defines an infringing copy as an article whose making constituted an infringement of the copyright in the work. It also treats as an infringing copy an article that has been or is proposed to be imported into the United Kingdom and whose making in the United Kingdom would have infringed the copyright or breached an exclusive licence agreement relating to the work.

That importing limb does not apply to an article that has been or is proposed to be imported after being put into circulation in the EEA by or with the consent of the copyright owner, or to one that may lawfully be imported by virtue of assimilated law. Section 27(6) also treats as an infringing copy a copy that falls to be treated as one under section 29A(3), the provision for copies made for text and data analysis for non-commercial research.

An infringement of copyright is actionable by the copyright owner. In an action for infringement, damages, injunctions and accounts are available as for the infringement of any other property right. Section 107 makes importing or distributing an infringing copy a criminal offence where the person knows or has reason to believe that the article is one. Sections 22, 23 and 27 came into force on 1 August 1989 as part of Part I of the Act.

Sections 135 to 137 of the Data (Use and Access) Act 2025 bind only the Secretary of State. Section 135 required an economic impact assessment of the four policy options in the government's December 2024 consultation on copyright and AI, section 136 required a report on the use of copyright works in the development of AI systems, and section 137 required a progress statement to Parliament unless both had already been published within six months.

Section 136(3) directs the report to consider and make proposals on technical measures and standards that control how copyright works are accessed for AI development (for example by web crawlers), on disclosure by AI developers of how they access works, on licensing, and on enforcement. The sections create no duty, exception or liability for a crawler operator or model developer.

Section 29A permits a person with lawful access to a work to make a copy of it for computational analysis, without infringing copyright, but only where the copy is made so that a person with lawful access can carry out that analysis for the sole purpose of non-commercial research, and the copy carries a sufficient acknowledgement.

The copy becomes an infringing copy if it is transferred to anyone else, other than with the copyright owner's authorisation, or used for any purpose beyond that non-commercial research purpose. A contract term purporting to prevent or restrict the making of a copy that this section would otherwise permit is unenforceable.

Because the exception is limited to non-commercial research, crawling third-party websites to collect training data for a commercial AI model does not fall within it, and depends instead on a licence or the rights holder's consent under the general copyright framework.

The government's Report on Copyright and Artificial Intelligence, published 18 March 2026 following its 2024-25 consultation, stated that a broad text-and-data-mining exception with a machine-readable opt-out is no longer the government's preferred way forward, so the position described here is expected to remain the status quo for the near term.

Regulation 13 creates a sui generis property right, database right, in a database where there has been substantial investment, whether financial, human or technical, in obtaining, verifying or presenting its contents; the right does not depend on the database or its contents being a copyright work.

Regulation 16 provides that a person infringes database right if, without the rightholder's consent, they extract or re-utilise all or a substantial part of the database's contents, and that the repeated and systematic extraction or re-utilisation of insubstantial parts may itself amount to extracting a substantial part. Regulation 12 defines extraction as the permanent or temporary transfer of the contents to another medium by any means or in any form.

The same regulation defines re-utilisation as making the contents available to the public by any means.

Regulation 17 gives database right a term of fifteen years from the end of the calendar year in which the database was completed, or from when it was first made available to the public if earlier, and a substantial change to the database's contents, including one built up from successive additions, deletions or alterations, that amounts to a substantial new investment gives the resulting database its own new fifteen-year term.

A manufacturer of a UK consumer connectable product, an internet- or network-connectable product that is not excepted, must comply with the security requirements of the 2023 Regulations, and an importer or distributor who supplies the product must not do so while aware of a manufacturer compliance failure.

Schedule 1 of the Regulations bans universal or easily guessable default passwords and requires the manufacturer to publish a point of contact for reporting a security issue, with a commitment on when the reporter will get an acknowledgment and status updates. The manufacturer must publish the minimum period for which security updates will be provided. That published period cannot later be shortened once it is published.

The duties reach firmware, software pre-installed on the product, and companion software that must be installed for the product's intended purpose. The reporting-contact and update-period duties do not reach the software of a smartphone or a cellular-capable tablet computer. The excepted-products schedule separately excepts a desktop computer, a laptop computer, and a non-cellular tablet computer, unless the product is designed for a child under 14.

It also excepts an electric-vehicle charge point, most medical devices, and an assured smart-meter product from the regime entirely.

The Secretary of State, acting through the Office for Product Safety and Standards under a memorandum of understanding with the Department for Science, Innovation and Technology, enforces the regime with compliance, stop and recall notices and can impose a civil monetary penalty of up to the greater of 10,000,000 pounds sterling or 4% of a person's qualifying worldwide revenue.

OPSS guidance states a further daily penalty of up to 20,000 pounds sterling for continuing non-compliance with an enforcement notice. Failing to comply with an enforcement notice is separately a criminal offence carrying a fine.

Regulation 10 requires an operator of an essential service to take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which its essential service relies. Regulation 10 also requires an operator of an essential service to take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting those systems, with a view to ensuring the continuity of the service.

A person who provides an essential service listed in Schedule 2, whose service relies on network and information systems and meets the threshold requirement for that kind of service, is deemed designated as an operator of an essential service under regulation 8.

Section 105A requires the provider of a public electronic communications network or a public electronic communications service to take such measures as are appropriate and proportionate for the purposes of identifying, reducing and preparing for the risks of security compromises occurring. Section 105C requires the provider to take appropriate and proportionate measures to prevent adverse effects arising from a security compromise that occurs.

Section 105B lets the Secretary of State require by regulations that specified measures be taken. The Electronic Communications (Security Measures) Regulations 2022 do so from 1 October 2022. Under section 105W a person who sustains loss or damage from a breach of the section 105A to 105D duties may sue with the consent of OFCOM.

Regulation 12(1) requires a relevant digital service provider to identify and take appropriate and proportionate measures to manage the risks posed to the security of the network and information systems on which it relies to provide an online marketplace, an online search engine or a cloud computing service in the United Kingdom. Regulation 12(2) requires those measures to ensure, having regard to the state of the art, a level of security appropriate to the risk posed.

A provider is a relevant digital service provider only if it is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC.

Section 105K requires the provider of a public electronic communications network or a public electronic communications service to inform OFCOM as soon as reasonably practicable of any security compromise that has a significant effect on the operation of the network or service.

Section 105J requires the provider, where there is a significant risk of a security compromise occurring, to take reasonable and proportionate steps to bring the relevant information to the attention of the persons who use the network or service and may be adversely affected. The duties in sections 105J and 105K were inserted by the Telecommunications (Security) Act 2021 and took effect on 1 October 2022.

Regulation 11 requires an operator of an essential service to notify its designated competent authority in writing about any incident which has a significant impact on the continuity of the essential service it provides. The notification must be given without undue delay and in any event no later than 72 hours after the operator is aware that a NIS incident has occurred.

Regulation 12(9) separately requires an operator that relies on a relevant digital service provider to notify its competent authority, without undue delay, of any significant impact on the continuity of its service caused by an incident affecting that provider.

Regulation 12(3) requires a relevant digital service provider to notify the Information Commission in writing about any incident having a substantial impact on the provision of an online marketplace, online search engine or cloud computing service that it provides. The notification must be made without undue delay and in any event no later than 72 hours after the provider is first aware that an incident has occurred.

The requirement to notify applies only if the provider has access to information which enables it to assess whether the impact of an incident is substantial.

Regulation 22 requires an individual subscriber's prior consent before sending, or instigating the sending of, unsolicited electronic mail (a term that reaches SMS and other messaging, not only email) for direct marketing purposes, unless a soft opt-in applies because the sender obtained the recipient's details in a sale or sale negotiation, markets only its own similar products or services, and gave the recipient a free opt-out at collection and with every later message.

Since 5 February 2026 the Data (Use and Access) Act 2025 gives a charity the same soft opt-in where it obtained the recipient's details because the recipient expressed interest in, or offered support for, the charity's own charitable purpose, on the same free opt-out terms.

Regulation 23 separately bars sending a direct-marketing email that disguises or conceals the sender's identity or that omits a valid address for the recipient to ask that such communications stop, and bars one that would contravene, or that encourages a visit to a website that would contravene, the labelling and identification rules of the Electronic Commerce (EC Directive) Regulations 2002.

Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 bars a person from storing information, or gaining access to information already stored, in a subscriber's or user's terminal equipment, subject to the exceptions Schedule A1 lists.

Schedule A1, substituted with regulation 6 on 5 February 2026 by the Data (Use and Access) Act 2025, keeps the pre-existing consent exception, the exception for technical transmission, and the exception for storage or access strictly necessary for a requested information society service, and adds two new ones: collecting information for statistical purposes to improve a service or website, and adapting or enhancing a website's appearance or functionality, each conditioned on clear and comprehensive information to the subscriber or user and a simple, free means of objecting that they do not use.

Section 3 makes it a criminal offence to intentionally intercept a communication in the course of its transmission by a public or private telecommunication system or a public postal service in the United Kingdom without lawful authority, though a private system's own controller, or someone with that person's express or implied consent, does not commit this offence by intercepting on it.

Under section 4 a person intercepts a communication only if the effect of what they do is to make its content available to a person who is not its sender or intended recipient, so a party who records a call for their own use is outside the offence.

Section 44 gives lawful authority to intercept where both the sender and the intended recipient have consented, or where one of them has consented and surveillance by that interception is separately authorised under Part 2 of the Regulation of Investigatory Powers Act 2000.

Section 46, read with the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, gives lawful authority to a business, government department, public authority, or other body exercising a statutory function to intercept its own communications for a listed purpose, such as establishing facts, checking regulatory compliance, or securing the system's effective operation, on conditions including that the body has made all reasonable efforts to inform every person who may use the system that their communications may be intercepted.

Section 8 gives the sender or the intended recipient of a communication a civil claim against a private telecommunication system's own controller who intercepts it without lawful authority. The Regulation of Investigatory Powers Act 2000's own interception offence and civil-liability provisions were repealed in stages during 2018 as this Act's provisions came into force.

These provisions reach only a call or fax made for direct marketing purposes, not a purely informational or service call. Regulation 19 requires the called subscriber's prior consent before transmitting recorded matter for direct marketing purposes by an automated calling or communication system, and either presenting the calling line's identity or an alternative contact number.

Regulation 20 bars an unsolicited direct-marketing fax to an individual subscriber unless they consented, to a corporate subscriber who has objected, or to any subscriber whose number is on the fax-marketing register kept under regulation 25. The Information Commission keeps that register. Regulation 21 bars an unsolicited live telephone call for direct marketing to a subscriber who has registered an objection under regulation 26 or told the caller directly not to call.

Every direct-marketing call, solicited or unsolicited, must present a working calling-line identity or an alternative contact number. Regulation 21A requires the called individual's prior consent for an unsolicited call marketing claims management services, with no do-not-call-register exception.

Regulation 21B lets only an authorised person or a scheme's trustee or manager make an unsolicited call marketing occupational or personal pension schemes, and only with that consent or within an existing client relationship that carries a standing free means to object, again whatever the register says.

Regulation 24 requires a caller using an automated system or fax to give their name and either an address or a freephone number, and a live caller to give their name and, on request, that address or number.

Section 5 of the Defamation Act 2013 gives the operator of a website a defence to an action for defamation brought in respect of a statement posted on the website, if the operator shows that it was not the operator who posted the statement.

The defence is defeated if the claimant shows that it was not possible for the claimant to identify the person who posted the statement, that the claimant gave the operator a notice of complaint, and that the operator failed to respond to the notice as the regulations provide. A claimant can identify the poster only if the claimant has sufficient information to bring proceedings against that person.

The defence is also defeated if the claimant shows that the operator of the website has acted with malice in relation to the posting of the statement. The defence is not defeated by reason only of the fact that the operator moderates the statements that others post on the website. The Defamation (Operators of Websites) Regulations 2013 (SI 2013/3028) set what a notice of complaint must contain, beyond what section 5 requires.

The same Regulations set the steps an operator must take in response to a notice of complaint in order to maintain the section 5 defence. The operator must, for example, send the poster a copy of the notice of complaint within 48 hours of receiving it, unless paragraph 3 or 9 of the Schedule applies. In counting the 48 hours, any period that falls on a Saturday, Sunday, Good Friday, Christmas Day or a bank holiday in England and Wales is disregarded.

A court may, if it considers it in the interests of justice, treat action taken after a time limit expired as taken before it. The Act extends to England and Wales only.

Since 29 June 2026 the provider of a regulated user-to-user service must let users and affected persons easily make an intimate image content report, and must operate proportionate systems and processes to take down the reported content, and any other content it identifies as the same or substantially the same, as soon as reasonably practicable and no later than 48 hours after receiving the report.

An intimate image content report declares that the content is intimate image content and that the report is made by the subject of the content or a person acting on their behalf, in good faith and true to the best of the reporter's knowledge and belief, and it identifies the content and gives the reporter's contact details.

The 48-hour duty does not apply where the provider considers that the content is not intimate image content or that the reporter is neither the subject nor acting on the subject's behalf.

Intimate image content is content amounting to the offence of sharing an intimate photograph or film without consent, and a photograph or film includes an image made or altered by computer graphics or in any other way that appears to be one, so an AI-generated intimate image reported by the person it depicts is within the duty. The provider's terms of service must address the duty.

The Crime and Policing Act 2026 inserted these provisions into section 10 and section 20A, so Ofcom enforces them as part of the illegal content safety duties, with the same penalty of up to the greater of 18 million pounds and 10 percent of qualifying worldwide revenue.

Part 3 of the Online Safety Act 2023 places duties on the provider of a regulated user-to-user service, and a service has links with the United Kingdom if it has a significant number of UK users, if UK users are one of its target markets, or if it can be used here and there is a material risk of significant harm to people here.

Section 9 requires a suitable and sufficient illegal content risk assessment, kept up to date and repeated before any significant change to the service's design or operation, covering among other things the risk of users encountering each kind of priority illegal content and the risk that the service's functionalities facilitate illegal content.

Section 10 requires proportionate measures to prevent users encountering priority illegal content and to mitigate the risk of the service being used to commit or facilitate a priority offence, proportionate systems and processes to minimise how long priority illegal content is present and to take illegal content down swiftly once the provider is alerted to it, and terms of service that say how users are protected from illegal content and are applied consistently.

Priority illegal content is terrorism content, child sexual exploitation and abuse content, and content amounting to an offence listed in Schedule 7, which includes sharing an intimate image without consent and, since 29 June 2026, creating or requesting a purported intimate image of an adult.

For the intimate image offences a photograph or film includes an image made or altered by computer graphics or in any other way that appears to be one, so an AI-generated intimate image is within these duties. Sections 9 and 10 came into force on 10 January 2024, and Schedule 3 required a service already operating to complete its first illegal content risk assessment within three months of Ofcom publishing its risk assessment guidance.

Ofcom enforces the duties and can impose a penalty of up to the greater of 18 million pounds and 10 percent of qualifying worldwide revenue. The 48-hour take-down duty for intimate image content that the Crime and Policing Act 2026 added to section 10 is held as its own entry.

Where an automated vehicle causes an accident while driving itself on a road or other public place in Great Britain, and the vehicle is insured, the insurer is liable for the damage suffered by an insured person or any other person. An automated vehicle is a vehicle listed by the Secretary of State under section 1. A vehicle is driving itself if it is operating in a mode in which it is not being controlled, and does not need to be monitored, by an individual.

Where the vehicle is not insured and section 143 of the Road Traffic Act 1988 does not apply to it because of the exemption for public bodies or because it is in the public service of the Crown, the owner of the vehicle is liable for the damage a person suffers.

Damage means death or personal injury and damage to property other than the automated vehicle, goods carried for hire or reward in or on the vehicle or a trailer it draws, and property in the custody or under the control of the insured person (where the insurer is liable) or of the person in charge of the vehicle (where the owner is liable).

For damage to property in any one accident, the liability of the insurer or owner is limited to the amount specified in section 145(4)(b) of the Road Traffic Act 1988. Except as section 4 provides, liability cannot be limited or excluded by a term of an insurance policy or in any other way.

A policy may exclude or limit the insurer's liability to an insured person for an accident that is a direct result of software alterations made by that person, or with that person's knowledge, that the policy prohibits, or of a failure to install safety-critical software updates that the person knows or ought reasonably to know are safety-critical.

For an insured person who is not the holder of the policy, the software alterations limb applies only to alterations that the person knows, at the time of the accident, are prohibited under the policy. The insurer or owner is not liable to the person in charge where the accident was wholly due to that person's negligence in allowing the vehicle to begin driving itself when it was not appropriate to do so.

Once the liability of the insurer or owner to the injured party is settled, any other person liable to the injured party in respect of the accident is under the same liability to the insurer or owner. Liability under section 2 is treated as liability in tort or, in Scotland, delict, for the purposes of any enactment conferring jurisdiction on a court.

Schedule 2 to the Automated Vehicles Act 2024 provides for a new subsection (1A) to be substituted for section 8(1) of the 2018 Act, a change listed as yet to be applied to the Act's text.

Part I of the Consumer Protection Act 1987 makes liable for damage caused wholly or partly by a defect in a product its producer, any person who held themselves out as the producer by putting a name or trademark on the product, and any person who imported it into the United Kingdom to supply it in the course of business.

A supplier of a defective product is liable for the damage if the injured person asks it to identify a person liable under section 2(2), the request is made within a reasonable period after the damage occurs and when the injured person cannot reasonably identify all of them, and the supplier fails within a reasonable period to comply or to identify the person who supplied the product to it. Where two or more persons are liable for the same damage, their liability is joint and several.

Part I defines a product as any goods or electricity, including a product comprised in another product as a component part or raw material or otherwise. Part I states that it was enacted to comply with the product liability Directive and is to be construed accordingly. A product is defective if its safety is not such as persons generally are entitled to expect.

In deciding what persons generally are entitled to expect, all the circumstances are taken into account, including the manner in which and purposes for which the product has been marketed and any instructions or warnings. It is a defense that the defect is attributable to compliance with any requirement imposed by or under any enactment or with any assimilated obligation. It is a defense that the defect did not exist in the product at the relevant time.

For a person to whom section 2(2) applies, the relevant time is the time when that person supplied the product to another. It is a defense that the state of scientific and technical knowledge at the relevant time was not such that a producer of products of the same description might be expected to have discovered the defect if it had existed in his products while they were under his control.

The liability cannot be limited or excluded by any contract term, by any notice or by any other provision. Damage means death or personal injury or any loss of or damage to any property, but a person is not liable for loss of or damage to the product itself.

There is no liability for loss of or damage to property that is not of a description ordinarily intended for private use, occupation or consumption and intended by the person suffering the loss mainly for their own private use, occupation or consumption. No damages are awarded for loss of or damage to property if the amount that would be awarded, apart from this rule and any interest, does not exceed £275.

Schedule 1 to the Act inserts section 11A into the Limitation Act 1980 for England and Wales. Under section 11A of the Limitation Act 1980, an action for personal injury or property damage under Part I must be brought within three years of the later of the date the cause of action accrued and the date of knowledge of the injured person or, for property damage, of the claimant.

Under section 11A of the Limitation Act 1980, the right of action is extinguished ten years after the relevant time, whether or not it had accrued. The Law Commission of England and Wales notes that claimants may face significant evidential hurdles in proving defect and causation, particularly in complex technical cases. Part I came into force on March 1, 1988.

No person is made liable under Part I for damage caused by a defect in a product that its producer supplied before Part I came into force. The Act extends to Northern Ireland with specified exceptions. Part I binds the Crown, but only as far as the Crown is made liable in tort or in reparation under the Crown Proceedings Act 1947.

If the consumer requires a remedy, a trader that supplied digital content to a consumer under a contract must either repair the damage the digital content causes to the consumer's device or to other digital content that belongs to the consumer, or compensate the consumer with an appropriate payment, where the damage is of a kind that would not have occurred if the trader had exercised reasonable care and skill. Digital content means data which are produced and supplied in digital form.

A consumer is an individual acting for purposes that are wholly or mainly outside that individual's trade, business, craft or profession. A trader is a person acting for purposes relating to that person's trade, business, craft or profession. To repair, the trader must repair the damage within a reasonable time and without significant inconvenience to the consumer, and bear the necessary costs of repair.

A compensation payment must be made without undue delay, and in any event within 14 days beginning with the day on which the trader agrees that the consumer is entitled to it. A consumer with a right to a remedy may bring a claim in civil proceedings to enforce it. The Limitation Act 1980 applies to the claim as if it were an action founded on simple contract. Business includes the activities of any government department or local or public authority. Section 46 has been in force since October 1, 2015.

Requires providers that publish or display their own, non-user-generated pornographic content to ensure, using age verification or age estimation or both, that children cannot normally encounter that content. The method used must be highly effective at correctly determining whether a user is a child, and providers must keep written records and publish a public statement on the methods used. The duty in section 81 came into force on 17 January 2025.

Requires providers of information society services likely to be accessed by children in the UK to apply 15 standards of age appropriate design, such as privacy by default, data minimisation, and not using nudge techniques that weaken children's privacy protections, under a statutory code of practice issued by the Information Commissioner under the Data Protection Act 2018. The code came into force on 2 September 2020 with a 12 month transition period ending 2 September 2021.

The Information Commission and courts must take it into account where relevant when assessing UK GDPR compliance. The Information Commission took over the Information Commissioner's functions on 30 September 2026.

Sets out the measures Ofcom expects user-to-user and search services likely to be accessed by children to adopt to comply with the Online Safety Act's children's safety duties, including age assurance, safer default settings and algorithms, and content moderation; providers that follow the Codes are treated as compliant.

Ofcom published the final Codes on 24 April 2025; providers had to complete children's risk assessments by 24 July 2025 and have risk mitigation measures in place from 25 July 2025, after the Codes completed the required Parliamentary process.

Requires providers of regulated user-to-user services likely to be accessed by children in the UK to carry out children's risk assessments and to use proportionate measures, including age verification or age estimation where appropriate, to prevent children encountering primary priority content harmful to children such as pornography, self harm, suicide, and eating disorder content. Sections 11 and 12 came into force on 10 January 2024.

Section 3(1) of the Copyright, Designs and Patents Act 1988 defines a literary work as any work, other than a dramatic or musical work, which is written, spoken or sung. A literary work includes a computer program. A literary work also includes preparatory design material for a computer program. Copyright does not subsist in a literary work unless and until it is recorded, in writing or otherwise.

Section 16(1) gives the owner of the copyright in a work the exclusive right to do in the United Kingdom the acts of copying the work, issuing copies of it to the public, renting or lending it to the public, performing, showing or playing it in public, communicating it to the public, and making an adaptation of it or doing any of those acts in relation to an adaptation.

Under section 16(2), copyright in a work is infringed by a person who without the licence of the copyright owner does, or authorises another to do, any of the acts restricted by the copyright. Section 16(3) provides that references to the doing of an act restricted by the copyright are to the doing of it in relation to the work as a whole or any substantial part of it, either directly or indirectly, and that it is immaterial whether any intervening acts themselves infringe copyright.

Section 16(4) makes the section subject to the acts permitted in relation to copyright works in Chapter III of the Act and to the provisions on copyright licensing in Chapter VII. Section 21(1) makes the making of an adaptation of the work an act restricted by the copyright in a literary, dramatic or musical work, and an adaptation is made when it is recorded, in writing or otherwise.

Under section 21(2), doing any of the acts specified in sections 17 to 20, or making an adaptation, in relation to an adaptation of the work is also an act restricted by the copyright. Section 21(3)(ab) defines an adaptation, in relation to a computer program, as an arrangement or altered version of the program or a translation of it.

Section 21(4) provides that in relation to a computer program a translation includes a version of the program in which it is converted into or out of a computer language or code or into a different computer language or code. Section 21(5) provides that no inference is to be drawn from section 21 as to what does or does not amount to copying a work. Preparatory design material for a computer program was added to section 3(1) with effect from 1 January 1993.

The definition of an adaptation of a computer program in section 21(3)(ab) was inserted with effect from 1 January 1993. Part I of the Act, which includes sections 3, 16 and 21, came into force on 1 August 1989.

Section 20 of the Copyright, Designs and Patents Act 1988 makes the communication of a work to the public an act restricted by the copyright in the work. The restriction applies to copyright in a literary, dramatic, musical or artistic work, in a sound recording or film, and in a broadcast. In Part I of the Act, communication to the public means communication to the public by electronic transmission. That meaning includes the broadcasting of the work.

It also includes making the work available to the public by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them. The current text of section 20 was substituted with effect from 31 October 2003 by regulation 6(1) of the Copyright and Related Rights Regulations 2003 (SI 2003/2498).

Section 30(1ZA) provides that copyright in a work is not infringed by the use of a quotation from it, whether for criticism or review or otherwise, provided the work has been made available to the public, the use is fair dealing, the extent of the quotation is no more than required for the purpose it is used for, and it carries a sufficient acknowledgement (unless impossible for reasons of practicality or otherwise); a contract term purporting to override this quotation exception is unenforceable.

Section 30(1) separately permits fair dealing with a work for criticism or review, and section 30(2) permits fair dealing with a work, other than a photograph, for the purpose of reporting current events, each subject to a sufficient-acknowledgement requirement.

None of these provisions carries a headline-length or short-extract cap distinct from the fair-dealing and extent-justified tests, and no reported UK decision has applied section 30 specifically to a systematic news aggregator's reproduction of headlines and snippets, as opposed to an individual quoting a published work. The provisions this entry describes came into force on different days.