Mark Farrell

Cyber Incident Reporting in Financial Services

When a financial services firm suffers a cyber incident, the first question is usually technical: what has happened, and how do we contain it? Close behind comes a regulatory question that is getting harder to answer: who do we have to tell, and by when?

For years the data protection answer has been familiar. Report a personal data breach to the ICO within 72 hours. From 18 March 2027, most FCA-regulated firms will also have a 24-hour operational incident reporting duty. And the Cyber Security and Resilience Bill, now in the House of Lords, will put many of the sector’s key technology suppliers under their own 24-hour regime.

Each regime has its own test, its own regulator and its own clock. In this post we look at how they fit together, where they diverge, and what firms can do now so that one incident does not become three separate scrambles to provide information.

The Three Clocks

The table below sets out the three regimes side by side. The FCA regime applies directly to regulated firms. The Cyber Security and Resilience Bill mainly reaches financial services firms through their suppliers.

Two details stand out. The FCA clock runs from when the firm decides a threshold is met, while the ICO clock runs from when it becomes aware of a breach. And the FCA rules expressly treat loss of confidentiality of customer data as a type of operational incident, so a data breach can engage both regimes at once.

Different Tests, Different Answers

The regimes ask different questions. UK GDPR asks about risk to individuals. The FCA asks about serious harm to consumers, firms and markets. The Bill asks about the security and continuity of essential services. So the same incident can be reportable to one regulator and not another.

A few scenarios show how this plays out:

• A misdirected email. Fifty customers’ account statements are sent to the wrong recipient. That is very likely a reportable personal data breach. It is unlikely to meet the FCA’s thresholds, which the FCA says are intended only for serious incidents.
• Ransomware without exfiltration. Systems are encrypted and customers cannot access services for a day, but no data leaves the firm. This may well meet the FCA’s consumer harm threshold. It is also a personal data breach, because loss of availability counts, and whether it is reportable to the ICO depends on the risk to individuals.
• A blocked intrusion. An attacker gets into a supplier’s network but is stopped before reaching customer data. There is no personal data breach and nothing for the FCA, which has said firms do not have to report near misses under these rules. But the supplier may have a duty under the Bill, which captures some incidents by their potential impact.

The FCA has also said firms must not skip a report just because an incident falls below their internal severity rating. It points to signals such as involving a Senior Manager or activating crisis procedures as signs a threshold may be met. In our view, those same signals should prompt a fresh look at the data protection position too.

There is a structural point as well. FCA reports are made per regulated entity, so a group with several authorised firms may need several reports. Under UK GDPR, the question is which entities are controllers of the affected data. The two answers will not always match.

Your Suppliers May Report First

Third parties are now central to incident risk in financial services. The FCA says incidents originating at third parties have recently been the top root cause for firms. It also says over 40% of the cyber incidents reported to it in 2025 involved a third party.

Most financial services firms are not themselves in scope of the NIS regime. Many of their suppliers soon will be. The Bill brings in data centres above set capacity thresholds and medium and large managed service providers, such as outsourced IT, helpdesk and managed security providers. Those suppliers will have their own 24-hour duty to notify their regulator and the NCSC, and a duty to tell affected customers.

That creates an awkward possibility. A supplier could be reporting an incident to a regulator before its financial services customer has been told about it, let alone worked out what it means.

For the data protection team, this is where Article 28 contracts matter. A processor must tell the controller about a personal data breach without undue delay. Contracts often give processors longer than a firm can now afford, and some say nothing about incidents that do not involve personal data. A firm facing a 24-hour FCA expectation needs supplier clauses that match. The FCA reporting form even asks firms to name the third party where an incident originated with one.

One Incident, One Story

The biggest practical risk is not missing a deadline. It is telling different regulators different things.

In the first hours of an incident, facts are thin and change quickly. A firm might tell the FCA at hour 20 that no customer data appears to be affected, then tell the ICO at hour 70 that data was exfiltrated. Both reports may be accurate when made. But read side by side, they can look like a firm that was slow, confused or less than candid.

Regulators may compare notes. The FCA’s enhanced reporting form asks which other regulatory bodies have been notified. The FCA’s rules on inaccurate, false or misleading information apply to these reports. And Principle 11 requires firms to deal with the FCA openly.

Customers are a fourth audience. Under UK GDPR, people must be told without undue delay where a breach is likely to result in a high risk to them. Under the Bill, data centres and managed service providers will have to tell affected customers too. What customers hear should line up with what regulators hear.

The answer is a single incident record that every report draws from. It should log what was known and when, and be updated as facts change. Each regulator then gets a report tailored to its own test, but built on the same facts and timeline.

What to Do Before 18 March 2027

The FCA has given firms 12 months to prepare, and around half of that has already gone. These are the steps we would prioritise.

• Build one triage process. At the first sign of an incident, run the UK GDPR, FCA and (for suppliers) Bill tests together, rather than in separate teams at separate times.
• Put the DPO in the room early. The data protection assessment should start in the first hours, not once the operational picture has settled.
• Record decisions and timings. Log when the firm became aware of a breach and when it decided an FCA threshold was met. Those are different moments, and each regulator will ask about its own.
• Map reporting entities. Work out which group entities are FCA-regulated reporting firms and which are controllers, before an incident forces the question.
• Review supplier contracts. Check that breach and incident notification clauses are fast enough for a 24-hour clock and cover incidents that do not involve personal data.
• Prepare holding wording. Draft template reports for the ICO, the FCA and customers that share a common factual core.
• Test it. Run a test exercise against all three clocks, including a scenario that starts at a supplier.

Final Thoughts

Cyber security, operational resilience and data protection have often been run by different teams with different playbooks. The new reporting landscape makes that harder to sustain. One incident can now engage three regimes within the same three days.

Firms that treat this as one problem, with one triage process, one incident record and one set of facts, will find the clocks much easier to manage.

If you would like help aligning your breach response and incident reporting ahead of March 2027, get in touch with our financial services team at Data Protection People.

Sources

• FCA: PS26/2 Operational incident and third party reporting
• FCA: PS26/2 full policy statement and made rules (PDF)
• FCA: Reporting operational incidents
• ICO: 72 hours – how to respond to a personal data breach
• Hansard: Cyber Security and Resilience (Network and Information Systems) Bill, House of Lords, 14 July 2026
• Burges Salmon: UK Cyber Security and Resilience Bill – what you need to know
• Browne Jacobson: The UK Cyber Security and Resilience Bill – what you need to know

From the ICO to the Information Commission

With the Information Commissioner’s Office (ICO) transition to the “Information Commission” under the Data (Use and Access) Act (DUAA) 2025 set to be confirmed on 30 September 2026, it is an appropriate moment to look at what this change actually means for the regulator.

The transition is a structural evolution that will not change the fundamental role and responsibilities of the regulator. The DUAA amends references to “Information Commissioner” to the “Information Commission,” so all existing functions transfer over. The commencement regulations also ensure that actions taken by, or in relation to, the Information Commissioner before 30 September 2026 will continue to have effect after the transfer to the Information Commission.

It is fair to classify the transition as more administrative than substantive, especially from the perspective of organisations. For organisations, the change may involve nothing more than updating documentation to refer to the Information Commission. However, the transition represents more than a rebrand. The way the regulator is constituted, governed and held to account is genuinely changing.

The narrative around the DUAA changes often focuses on the perspective of organisations, reduction in regulatory burden, simplification of certain requirements and greater flexibility to process personal data. But what is the view from the regulator’s side, and what, if anything, can those subject to its authority expect to change?

Towards Board Governance

Moving from a governance structure built around a corporation sole (the Information Commissioner) to a body corporate (the Information Commission) modernises the UK’s data protection regulator, bringing it into alignment with other domestic regulators such as Ofcom and the Competition and Markets Authority (CMA).

Whilst the Information Commissioner had the final say in decision making, the Information Commission will operate with a board comprising the Chair of the Information Commission, a chief executive officer, and other non-executive and executive members who will share decision-making responsibilities.

In July 2026 the appointment of seven Non-Executive Members to the Information Commission Board was announced, Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson, alongside the launch of recruitment for the Chair of the Information Commission. The appointments are intended to give the new Board a wider range of skills and experience across business, technology, regulation, governance and public service, embedding strategic leadership and oversight within a collective governance structure.

The impact of this structural change will be to make the regulator less personality-led and more framework-led. A corporation sole should, in theory at least, offer decisiveness, but as we have seen, it is also liable to make regulatory tone and emphasis dependent on one individual’s instincts, leading to data protection laws “varying with the length of the Commissioner’s foot.”

Data protection regulation in the current age requires not just authority, but governance, oversight and expertise. A board structure brings all three, as well as greater resilience, continuity in strategy and a broader range of perspectives. Having a wider range of views factored into the regulator’s approach aligns with the formal expansion of the ICO’s regulatory priorities under the DUAA.

Beyond Protecting Personal Data

The DUAA introduces a fresh strategic framework for the regulator when carrying out its functions, built around a principal objective supported by several other key areas. The primary duty remains to secure an appropriate level of protection for personal data, alongside a new additional requirement to promote public trust and confidence in the processing of personal data.

The other factors set out in the DUAA, which the Commission must have regard for when carrying out its tasks and responsibilities, are not new priorities as such but existing areas of focus for the ICO that now gain formal recognition and reinforcement within the Commission’s overall remit, including:

• The desirability of promoting innovation
• The desirability of promoting competition
• The importance of the prevention, investigation, detection and prosecution of criminal offences
• The need to safeguard public and national security
• The fact that children merit specific protection with regard to their personal data

This broadening of the regulatory remit reflects the fact that the data protection regulator’s role is no longer confined to data breaches and individual rights, but increasingly involves supervision across emerging areas of public concern such as artificial intelligence, children’s data, biometrics, online tracking, cross-regulatory coordination and the relationship between data protection, competition and innovation.

Alongside this expanded focus is a duty for the Commission to consult other regulators on economic growth, innovation and competition, which will presumably take place through the existing DRCF (Digital Regulation Cooperation Forum), which brings together the ICO, the Financial Conduct Authority (FCA), Ofcom and the CMA.

This signals a move away from data protection being treated as a standalone compliance issue and toward a more joined-up regulatory model, in which privacy, competition, innovation and online safety are assessed alongside one another. In practice, this increases the likelihood of coordinated regulatory expectations, shared intelligence and scrutiny across regulators, meaning organisations may face a more consistent but also more demanding regulatory environment.

The Commission will be held accountable for this new remit by greater transparency requirements introduced by the DUAA, which require it to publish an annual analysis of its performance and report on regulatory action, including the nature of investigations, time taken and powers used. Requiring the regulator to explain not only what it prioritises but how efficiently it uses its powers and resources is intended to create a more publicly accountable institution.

Alongside factoring these considerations into its decision making, the Information Commission will also have a range of DUAA changes to oversee, each motivated by these same considerations. The changes around automated decision making and the scientific research exemption clearly reflect the promotion of innovation and competition. The recognised legitimate interest for sharing data for crime prevention and national security reflects the crime-based objective, and children’s data reforms, which embed children’s higher protection considerations more firmly into regulatory expectations, reflect the associated aim.

This combination of new regulatory considerations also shows up in the regulator’s prominent priorities for 2026, which include the AI and biometrics strategy, and the Children’s Code and its enforcement guidance. This broader remit will clearly come to permeate the Information Commission’s work across the board. So how is it likely to show up in future enforcement action?

The Enforcement Forecast

The ICO’s recent enforcement track record has remained broadly aligned to the primary objective of protecting personal data, data rights and upholding public trust, with many headline sanctions relating to data security breaches, including the Capita, Advanced Computer Software, 23andMe and LastPass fines.

However, recent action taken against TikTok and Reddit, centred on proactively protecting children’s data, points to the ICO broadening its focus beyond data security breaches, reflecting the wider regulatory priorities formalised by the DUAA. Children’s data is best viewed not as one priority among many, but as an increasingly cross-cutting theme across all the newly formalised regulatory priorities.

Whether the enforcement picture will change following the increased monetary penalties for PECR breaches, which bring this regime in line with the UK GDPR, is debatable. The clear point to make is that PECR can no longer be treated as a poor relation of the UK GDPR and should attract the same level of compliance focus.

However, there is a valid observation that PECR fines tend to be imposed against cold callers and those operating in flagrant disregard for the requirements, often lacking the financial means to meet fines imposed under the previous £500,000 threshold, let alone fines within UK GDPR limits.

It is likely that the threshold increase is focused on deterrence, with the original threshold not providing enough of one. Whilst it is debatable whether the ICO will issue significantly larger PECR fines than before, it is worth bearing in mind that historically more fines have been issued under PECR than the UK GDPR, partly because PECR breaches are more straightforward for the regulator to evidence.

The overall trend of enforcement action in recent years, despite the ICO’s public sector approach, has been upward, and it is likely to continue on this trajectory, especially given the new enforcement procedural guidance set to replace the 2018 Regulatory Action Policy, which will determine how the ICO operates in view of the expanded powers conferred by the DUAA.

In particular, the introduction of structured settlement procedures akin to those used by the FCA and Ofcom, offering discounts to fines of up to 40% for early resolution before a notice of intent, 30% after notice of intent and 20% after written representations, points to a regulator keen to settle cases quicker, avoid time-consuming litigation and free up capacity for further enforcement. These priorities are also furthered by new evidence gathering powers.

Enhanced Evidence Gathering

The headline new evidence gathering capabilities conferred on the ICO, and soon the Information Commission, under the DUAA are powers to:

• Compel production of specific documents (in force since 19 August 2025)
• Compel a witness to attend an interview (in force since 5 February 2026)
• Request technical reports

These powers strengthen the regulator’s evidence gathering tools in response to investigative challenges. The first clarifies the regulator’s existing power to issue Information Notices, ensuring this expressly includes specific documents. The second allows the regulator to compel anyone working for the controller or processor, currently or previously, to attend an interview, removing reliance on voluntary interviews.

The first two powers are likely to be used primarily to deal with uncooperative respondents. A regulator having to use these powers at all is likely to be treated as an aggravating factor when sanctions and penalties are decided. However, it is the third power that is the most eye-catching, and likely the most impactful for the regulator, data subjects and organisations alike.

For the regulator, the power to mandate production of a report by an approved person, at the cost of the organisation and with specific subject matter, form, manner and date of preparation, should free up capacity to investigate and sanction more organisations. This is especially true given this power is likely to be used for technical and cyber-related matters, which are particularly resource and time intensive for the ICO.

These reports also have the potential to become more easily available to claimants than other internally produced equivalents, and could be highly advantageous for advancing legal claims. This is worth considering given the rise in the UK of collective and representative data breach claims, and the fact that the ICO appears content with data subjects placing increasing pressure on organisations.

Complaints: Lightening the Regulator’s Burden

The overall intention of the DUAA complaints changes (full article here) is not only to increase the obligation on organisations to resolve data protection complaints raised by individuals, but in turn to reduce the burden placed on the ICO by the large volume of complaints made to it directly. This is being achieved by:

• Giving individuals the legal right to raise data protection complaints with organisations directly, where previously they only had the legal right to complain to the ICO
• Requiring organisations by law to facilitate and address data protection complaints made directly to them, rather than this being merely a regulatory expectation
• Allowing the ICO to defer individuals and organisations until the organisation’s own complaints process is exhausted and regulatory involvement is warranted

Alongside the DUAA complaints changes, the ICO has published a new framework on how it handles complaints, aimed at more effectively managing the large and increasing volumes it receives. There is also an intention to further use complaint data, both the ICO’s own and that which it can now also request from organisations following the DUAA, to help identify broader issues with organisational compliance and inform regulatory interventions.

The overall aim of the framework is to focus resources on cases where the ICO can have the biggest impact and where issues align with strategic priorities, reinforcing the message that the regulator cannot act on every complaint. This has long been an aspiration, and the regulator will hope it becomes far more achievable following the DUAA changes. Whether this actually changes the picture for a cross-sector regulator that has tended to become overrun by complaints remains to be seen, though the intention is clearly to free up and better target resources toward key, impactful issues.

Conclusion

The government and the ICO have presented the DUAA as a reform package focused on promoting innovation, supporting growth and making compliance easier for organisations. There is truth in that, the Act relaxes and clarifies certain requirements, for example around scientific research, recognised legitimate interests, cookies and automated decision-making. But the transition to the Information Commission shows that simplification is only half the story.

The other half is a regulator designed to be more strategically oriented, better equipped and more assertive in its regulatory action. Organisations taking advantage of the greater flexibility permitted by the DUAA should be mindful that this freedom comes with a string attached: the regulator is better equipped to investigate and penalise should things go wrong. In that sense, the regulatory environment may have become easier to understand in some areas, but not necessarily easier to navigate.

Ultimately, this is not a shift from more regulation to less, but from an older model of data protection oversight to a newer version that is board-governed, strategically accountable and more appropriately calibrated for the emerging pressures of AI, digital markets, children’s privacy and an increasingly sophisticated enforcement picture. That is the real significance of the move from the ICO to the Information Commission.

When Two Rulebooks Collide: Data Protection and Financial Crime Regulation

When Two Rulebooks Collide: Data Protection and Financial Crime Regulation

Financial services firms are often expected to do two things at once: know more about their customers and collect less data about them.

This is the practical tension between financial crime regulation and data protection law. Both carry serious regulatory consequences, but they ask different questions of the same customer record.

Financial crime rules focus on whether a firm knows enough to identify and manage risk. Data protection law asks whether each item of personal data is necessary, lawful, secure and retained for no longer than needed.

The challenge affects customer onboarding, transaction monitoring, retention, technology, supplier management and the evidence a firm can produce when challenged. Firms that treat data protection and financial crime compliance as separate workstreams often only address the overlap when something goes wrong.

The Core Challenge

The practical question is whether a firm can show that each item of customer data has a defined regulatory purpose, a proportionate risk trigger, a controlled access route and a clear retention outcome.

This means considering where the two regimes overlap and where they create tension, particularly around collection, retention, outsourcing, governance and emerging technology.

Collection: Need to Know vs Just in Case

The first point of friction is collection.

The Money Laundering Regulations 2017 require customer due diligence and, in higher-risk situations, enhanced due diligence. In practice, this can mean collecting detailed information about source of funds, source of wealth, beneficial ownership, corporate structures and transaction behaviour.

At the same time, the UK GDPR requires organisations to collect personal data that is adequate, relevant and limited to what is necessary. This is known as data minimisation.

Data minimisation does not mean collecting as little information as possible in every situation. It means being able to explain why each data point is needed for a defined purpose.

Problems arise when firms collect more information simply because they can, or because teams are worried about getting anti-money laundering requirements wrong. This can lead to data being collected just in case without a clear risk-based reason.

A stronger approach is to apply the risk-based logic already built into the Money Laundering Regulations. Enhanced information gathering should be linked to a genuine, documented risk trigger. Standard-risk customers should not automatically be subject to the same level of collection.

For each category of data, firms should be able to explain:

• Which legal or regulatory obligation supports collection
• What risk factor triggered the request
• Who can access the information
• When the need for the information will be reviewed

Retention: Delete Less, Delete More

Retention is another area where financial crime obligations and data protection expectations can appear to conflict.

The UK GDPR requires personal data to be kept in an identifiable form for no longer than necessary. However, the Money Laundering Regulations require relevant records to be retained for five years after the end of a business relationship or the completion of an occasional transaction, subject to the detailed requirements of the Regulations.

This does not mean anti-money laundering obligations automatically override data protection law. It means firms need a precise retention analysis.

The lawful basis for retaining anti-money laundering records will often be compliance with a legal obligation under Article 6(1)(c) UK GDPR. However, a robust retention schedule should distinguish between different record types, including:

• Customer identification records
• Verification evidence
• Risk assessments
• Transaction monitoring alerts
• Suspicious activity escalation material
• Sanctions screening results
• Call recordings
• Suitability files and advice records

Each category may have a different legal basis, retention trigger and deletion point. Some records may need to be retained because anti-money laundering law requires it. Others may be retained because FCA rules, limitation periods or advice obligations apply. Others should be deleted, anonymised or access-restricted once their purpose has expired.

Delete records too early and the firm may be unable to evidence adequate due diligence or monitoring. Keep everything indefinitely and the firm risks unlawful over-retention, greater breach impact and weaker accountability.

Outsourcing, Suppliers and Operational Resilience

A single supplier can create several overlapping compliance requirements.

A cloud provider, KYC screening tool, transaction monitoring platform or credit reference relationship may require an Article 28 processor assessment, international transfer analysis where relevant, an information security review, financial crime due diligence, an outsourcing assessment and an operational resilience assessment.

These reviews overlap, but they are not the same.

Data protection asks about processing instructions, sub-processors, security, deletion, audit rights and international transfers. Financial crime asks whether a tool supports effective due diligence, screening, monitoring and escalation. Operational resilience asks whether the service supports an important business service, what happens if it fails and whether exit plans are credible.

Running these reviews separately can create duplicated effort and regulatory blind spots. A supplier may pass a data protection assessment but fail to meet operational resilience expectations. Another may offer strong functionality but have weak deletion controls, access management or transfer transparency.

The answer is integrated supplier governance. This means one intake process, one risk classification, one evidence pack and the right specialist sign-off at each stage.

The FCA and ICO’s March 2026 joint statement on vulnerability-related data makes a similar point. Data protection law does not prevent firms from delivering good outcomes under the Consumer Duty, but firms must still meet their data protection obligations. One regulatory regime should not become an excuse for failing another.

Independence Does Not Mean Isolation

Closer coordination should not compromise the independence of the Data Protection Officer.

Article 38 UK GDPR requires that a DPO is not instructed on how to perform their tasks and is not placed in a conflict of interest. However, independence of judgement is not the same as isolation from the process.

A DPO can remain independent while being involved early in retention design, supplier assessment, model governance, data protection impact assessments and data mapping.

In fact, late-stage review can weaken effective oversight. By the time a system is configured, data has been collected or a supplier has been appointed, the commercial decision may already be difficult to change.

The same applies to financial crime teams. Data protection should not be seen as a paper exercise that slows down effective controls. Good minimisation, access control and retention practices can make financial crime information more accurate, better governed and easier to evidence.

Emerging Technology

Privacy-enhancing technologies may eventually help firms reduce the tension between financial crime detection and data minimisation.

These are technologies designed to gain insight from data while reducing unnecessary exposure of the underlying information. Examples include federated learning, secure multi-party computation, fully homomorphic encryption and differentially private synthetic data.

They could be valuable for anti-money laundering and fraud detection, where suspicious patterns are often easier to identify across wider datasets. Developments such as Singapore’s COSMIC platform also show the direction of travel towards more controlled, purpose-specific information sharing.

However, these technologies should be treated as emerging developments rather than immediate compliance fixes. Many remain difficult to deploy at scale due to cost, technical complexity, immature supplier tooling, performance limitations and evolving regulatory expectations.

They also do not remove the need for strong governance. A firm using privacy-enhancing technology would still need a clear lawful basis, a documented assessment of necessity and proportionality, appropriate retention rules, supplier controls and security assurance.

What Good Practice Looks Like

Firms that manage this tension well tend to do five things.

1. Maintain one reliable data inventory. A single data inventory should support both Article 30 records of processing and financial services governance records. Separate teams should not maintain inconsistent versions of the same information.
2. Build retention schedules together. The DPO, MLRO, legal, operations and records teams should agree the legal basis, retention period and deletion point for each record category.
3. Apply risk-based collection. Enhanced data gathering should be linked to documented risk triggers, not habit, fear or supplier defaults.
4. Join up supplier governance. Data protection, financial crime, information security and operational resilience reviews should work through one coordinated process.
5. Involve data protection early. Data protection should be part of model governance, transaction monitoring design and customer decision-making from the beginning. Automated or analytics-led controls should be explainable, proportionate and supported by clear data lineage.

One Operating Model, Not Two Separate Rulebooks

The firms best placed to manage this challenge recognise the overlap and deliberately design governance that works across both regimes.

The answer is not to prioritise data protection over financial crime regulation, or vice versa. It is to build an operating model that supports proportionate collection, lawful retention, controlled sharing, resilient outsourcing and evidence that can stand up to scrutiny.

For firms under pressure to detect financial crime, protect customers and minimise personal data, that joined-up approach is essential.

This article provides general information and is not legal advice.

From the ICO to the Information Commission

From the ICO to the Information Commission: What the Change Really Means

By Mark Farrell, Data Protection Consultant at Data Protection People

In this article: Mark Farrell explores how the Data (Use and Access) Act (DUAA) 2025 will transform the ICO into the Information Commission, examining changes to governance, enforcement powers, accountability, complaints handling and what organisations should expect from the UK’s evolving data protection regulator.

With the Information Commissioner’s Office (ICO) announcing temporary governance changes in response to the ongoing workplace investigation into current Commissioner John Edwards, it seems an appropriate moment to delve into the permanent governance changes that are set to take effect under the Data (Use and Access) Act (DUAA) 2025 later this year (date yet to be confirmed).

The UK data protection regulator’s formal transition from the ICO to the Information Commission is a structural evolution that will not change the fundamental role and responsibilities of the regulator. The DUAA amends references to ‘Information Commissioner’ to the ‘Information Commission’ so all existing functions transfer over.

However, the change represents more than mere rebranding. The way the regulator is constituted, governed and held to account is changing in a significant way. The narrative around DUAA often focuses on the organisational perspective, reduction in regulatory burden, simplification of certain requirements and greater flexibility to process personal data, but what is the view for the regulator?

Towards Board Governance

Moving from a governance structure built around a corporation sole (the Information Commissioner) to a body corporate (the Information Commission) modernises the UK’s data protection regulator, bringing it into alignment with other domestic regulators such as Ofcom and the Competition and Markets Authority (CMA).

Whilst the Information Commissioner had the final say in decision making, once in place the Information Commission will operate with a board comprising the Chair of the Information Commission, a chief executive officer, and other non-executive and executive members who will share decision-making responsibilities.

The impact of this structural change will be to make the regulator less personality-led and more framework-led. A corporation sole should (in theory at least) offer decisiveness, but as we have seen, is also liable to make regulatory tone and emphasis dependent on one individual’s instincts, leading to data protection laws “varying with the length of the Commissioner’s foot.”

Data protection regulation in the current age requires not just authority, but governance, oversight and expertise. A board structure brings all three, as well as greater resilience, continuity in strategy and a broader range of perspectives. Having a wider range of views factored into the regulator’s approach aligns with the formal expansion of the ICO’s regulatory priorities under the DUAA.

Beyond Protecting Personal Data

The DUAA introduces a fresh strategic framework for the regulator when carrying out its functions, entailing a principal objective supported by several other key areas. The primary duty remains to secure an appropriate level of protection for personal data, alongside a new additional requirement to promote public trust and confidence in the processing of personal data.

The other factors outlined in the DUAA updates which the Commission must have regard for when undertaking its tasks and responsibilities are not new priorities per se but rather existing areas of focus for the ICO which now gain formal recognition and reinforcement as key areas that should be considered within the Commission’s overall remit including:

• the desirability of promoting innovation;
• the desirability of promoting competition;
• the importance of the prevention, investigation, detection and prosecution of criminal offences;
• the need to safeguard public and national security;
• the fact that children merit specific protection with regard to their personal data.

This broadening of official regulatory remit is in recognition of the data protection regulator’s role no longer being confined to data breaches and individual rights but increasingly entailing supervision across emerging areas of public concern such as artificial intelligence, children’s data, biometrics, online tracking, cross-regulatory coordination and the relationship between data protection, competition and innovation.

In addition to these expanded areas of focus is also the duty for the Commission to consult other regulators regarding economic growth, innovation and competition, which will presumably take place through the existing DRCF (Digital Regulation Cooperation Forum) which brings together the ICO, Financial Conduct Authority (FCA), Ofcom and the CMA (Competition and Markets Authority).

This signals a move away from data protection being treated as a standalone compliance issue and toward a more joined-up regulatory model in which privacy, competition, innovation and online safety are assessed alongside one another. In practice, this increases the likelihood of coordinated regulatory expectations, shared intelligence and scrutiny across regulators, meaning organisations may face a more consistent but also more demanding regulatory environment.

The Commission will be held accountable on this new remit by greater transparency requirements introduced by the DUAA, requiring the Commission to publish an annual analysis of its performance and report on regulatory action including the nature of investigations, time taken and powers used. Requiring the regulator to explain not only what it prioritises but how efficiently it uses its powers and resources is intended to create a more publicly accountable institution.

As well as factoring these considerations into its decision making, the Information Commission will also have a range of DUAA changes to oversee which are motivated by these considerations.

The Enforcement Forecast

The ICO’s recent enforcement track record has remained broadly aligned to the primary objective of protecting personal data, data rights and upholding public trust, with many headline sanctions pertaining to data security breaches, including the Capita, Advanced Computer Software, 23andMe and LastPass fines.

However, recent action taken against TikTok and Reddit centred on proactively protecting children’s data points to the ICO broadening its focus beyond data security breaches, reflecting the wider regulatory priorities formalised by the DUAA. Indeed, children’s data is best viewed not as one priority among many but as an increasingly cross-cutting theme across all the newly formalised regulatory priorities.

The extent to which the enforcement picture will change following the increased monetary penalties for PECR breaches, which brings this regime in line with the UK GDPR, is debatable.

It is likely that the threshold increase is focused on the deterrent effect, with the original threshold seemingly not providing enough in this regard.

The overall trend of enforcement action in recent years, despite the ICO’s public sector approach, has been upward and it is likely to continue on this trajectory, especially in view of the new enforcement procedural guidance which is set to replace the 2018 Regulatory Action Policy and will determine how the ICO operates in view of the expanded powers conferred by the DUAA.

Enhanced Evidence Gathering

The headline changes in terms of new ICO (and soon to be Information Commission) evidence gathering capabilities conferred under the DUAA are powers to:

• Compel production of specific documents
• Compel a witness to attend an interview
• Request technical reports

These powers strengthen the regulator’s evidence gathering tools in response to investigative challenges.

For the regulator, the power to mandate production of a report by an approved person at the cost of the organisation and with specific subject matter, form, manner and date of preparation, should free up capacity to investigate and sanction more organisations.

There is the potential for these reports to become more easily available to claimants than other internally produced equivalents, and one would suspect they could be highly advantageous for advancing legal claims.

Complaints: Lightening the Regulator’s Burden

The overall intention of the DUAA complaints changes is not only to increase the obligation and responsibility on organisations for resolving data protection complaints raised by individuals but to in turn reduce the burden placed on the ICO by the large volume of complaints made to it.

In tandem with the DUAA complaints changes, the ICO has published a new framework on how it handles complaints, targeted at more effectively managing the large and increasing volumes of complaints received.

The overall aim of the framework is to focus resources on cases where the ICO can have the biggest impact and where issues align with strategic priorities.

Conclusion

The government and the ICO have presented the DUAA as a reform package focused on promoting innovation, supporting growth and making compliance easier for organisations.

There is truth in that, the Act relaxes and clarifies certain requirements, for example around scientific research, recognised legitimate interests, cookies and automated decision-making, but the transition to the Information Commission shows that simplification is only half the story.

The other half is a regulator designed to be more strategically oriented, better equipped and more assertive in regulatory action.

Organisations, when taking advantage of the greater flexibility permitted by the DUAA, should be mindful that this freedom comes with a string attached, the regulator is better equipped to investigate and penalise should things go wrong.

Ultimately, this is not a shift from more regulation to less but from an older model of data protection oversight to a newer version that is board-governed, strategically accountable and more appropriately calibrated for the emerging pressures of AI, digital markets, children’s privacy and the increasingly sophisticated enforcement picture that follows.

Mark Farrell is a Data Protection Consultant at Data Protection People. Mark specialises in UK GDPR compliance, information governance, regulatory developments and the practical application of data protection law. He regularly advises organisations on emerging legislative changes, enforcement trends and regulatory risk management.

For more discussions on UK GDPR, data protection and regulatory developments, explore the Data Protection Made Easy Podcast.

S2 Ep28 GDPR Radio – Data Protection News of the Week

S2 Ep28: GDPR Radio – Data Protection News of the Week

Amber Sivill and Mark Farrell discuss recent data breaches, AI risks and privacy enforcement.

From preventable spreadsheet errors to AI-generated decisions, this episode explores the changing risks facing organisations and data protection professionals.

Amber and Mark examine recent incidents involving government departments, exposed AI conversations, employee access to personal data and the growing use of facial recognition technology.

What This Episode Covers

In this episode, Amber and Mark discuss:

• The Ministry of Defence data breach and the importance of basic software training
• The cyber attack affecting the Department for Education
• How AI can support both cyber attacks and defensive security measures
• Claude conversations appearing in Google search results
• AI-generated information being used in public-sector decisions
• New transparency requirements under the EU AI Act
• The risks created by unsecured paper records
• Unauthorised employee access to personal data
• AI-generated inferences and the future of anonymised data
• Facial recognition, smart surveillance technology and privacy
• Recent ICO action relating to nuisance marketing messages

When Basic Training Is Overlooked

The episode begins with the Ministry of Defence data breach involving information about Afghan relocation applicants.

Amber and Mark discuss reports that the breach could have been prevented through basic spreadsheet training. They also consider what this tells organisations about accountability and the importance of practical training.

Mark explains:

“AI is going to be leveraged to launch cyber attacks, it also has to be leveraged to combat them.”

The discussion also covers the cyber attack affecting the Department for Education. This demonstrates why organisations need both effective security systems and staff who understand how to recognise potential threats.

Privacy by Design and AI Tools

Amber and Mark discuss reports that shared Claude conversations appeared in Google search results.

The incident raises questions about transparency, default privacy settings and whether users understand when their conversations may become publicly available.

Amber says:

“You need to embed that sort of privacy, privacy by design, privacy by default, making sure that you know the default setting isn’t that my personal conversations are being shared publicly for other people to see.”

Organisations should understand how an AI service handles information before employees enter personal, confidential or commercially sensitive data into it.

AI Decisions and Regulatory Oversight

The hosts examine a case involving information believed to have been generated by AI and used during an asylum decision.

They discuss the risks of relying on AI-generated material without proper fact-checking or meaningful human oversight. Meaningful human oversight means a person genuinely reviews the information and can challenge or change the outcome.

The conversation also covers EU AI Act transparency requirements and the need for clearer UK rules.

Amber explains:

“I think this just goes to show that the current legislation doesn’t fit. I think it fits in so many ways in terms of the principles, but we need more specifics that are tailored towards AI use.”

Paper Records and Employee Access

Not every data protection incident involves sophisticated technology.

Amber and Mark discuss confidential paper records reportedly found in an unsecured former council building. They also examine cases involving employees accessing personal records without authorisation.

These stories show why organisations must protect information throughout its lifecycle. This includes digital files, archived documents and paper records.

Access controls should also ensure that employees can only view information they genuinely need for their role.

AI Inferences and Anonymised Data

The episode considers how AI may infer sensitive information from data that appears to be aggregated or anonymised.

Anonymised data is information that can no longer be linked to an identifiable person. However, more capable technology may make it easier to identify patterns or combine information from different sources.

Amber and Mark discuss whether existing definitions and safeguards will remain effective as AI develops.

Facial Recognition and Smart Surveillance

The hosts also examine AI-enabled street technology that can use cameras and facial recognition to identify people or detect potential offences.

These tools may support law enforcement and public safety. However, they also create questions about proportionality, transparency and function creep. Function creep happens when information or technology is gradually used for purposes beyond the reason it was originally introduced.

Mark summarises one of the central concerns:

“You behave differently when you’re being watched.”

Recent ICO Enforcement

The episode closes with recent action from the Information Commissioner’s Office relating to nuisance marketing about motor finance claims.

Amber and Mark discuss the use of search warrants and cooperation between different regulators. They also consider whether enforcement is being applied consistently across organisations and sectors.

Practical Takeaways for Organisations

Organisations should:

• Include practical software skills in data protection training
• Review the privacy settings of AI tools before using them
• Avoid entering sensitive information into systems without appropriate safeguards
• Apply meaningful human oversight to AI-supported decisions
• Protect paper records as carefully as digital information
• Regularly review employee access permissions
• Assess whether anonymised information could be re-identified
• Consider privacy risks before introducing surveillance technology

Watch or Listen

Watch or listen to the full episode of GDPR Radio:

📺 Watch the episode on YouTube

🎧 Listen to the episode on Spotify

Meet Your Hosts

Amber Sivill

Amber explores how emerging technology, AI governance and privacy risks affect organisations in practice.

Mark Farrell

Mark examines recent data protection developments and the practical lessons organisations can take from them.

Data Protection Made Easy

Data Protection Made Easy helps organisations understand and meet their responsibilities under UK GDPR and related data protection law.

ICO Guidance on the DUA

ICO Guidance on the Data (Use and Access) Act (DUA): What You Need to Know

The Information Commissioner’s Office (ICO) has released guidance on handling data protection complaints in line with the requirements from the Data (Use and Access) Act (DUAA) which are set to come into force on 19 June 2026.

Whilst most of the reforms brought about by Part 5 of the DUAA took effect on February 5, organisations have longer to prepare for the complaint requirements and the ICO’s guidance supports organisations on achieving best practice ahead of time.

What does the DUAA change regarding data protection complaints?

Whilst the ICO has previously expected organisations to address data protection complaints received from individuals, this has not been backed up by any legal obligation.

Following the changes under the DUAA, individuals now have the legal right to submit a complaint to an organisation about the handling of their personal data and organisations must implement processes and procedures to facilitate this.

What are the key requirements for handling data protection complaints in line with the DUAA and ICO guidance?

The ICO’s latest guidance outlines the following key steps organisations must take to meet the complaint requirements under the DUAA:

• Provide individuals with a way of making data protection complaints;
• Acknowledge data protection complaints within 30 days of receipt;
• Take appropriate steps to respond to complaints without undue delay, including making appropriate enquiries and keeping complainants informed; and
• Provide people with complaint outcomes without undue delay.

For organisations with existing complaints procedures, only minor changes are likely needed to reflect the DUAA requirements, but organisations lacking an established complaints process will now be expected to implement a substantive procedure.

This article highlights the key areas of focus for organisations in preparation for the DUAA complaints provisions coming into force and summarises recommendations for best practice based on the ICO’s guidance.

What constitutes a data protection complaint?

Not every complaint that is linked to data protection matters constitutes a data protection complaint. Where an individual complains about an organisation’s services or other matters whilst also exercising data protection rights this does not count, e.g. an employee raises a grievance and at the same time makes a subject access request.

The ICO’s guidance clarifies that data protection complaints arise where an individual complains specifically about an organisation’s handling of their personal data, whether this be about the handling of a subject access request (SAR) or quality of data security.

As with other personal data rights requests, individuals do not have to use legal terms of quote the legislation to make a data protection complaint. Where unsure if an individual is making a data protection complaint, organisations should seek clarification.

What must we do to prepare for handling data protection complaints?

Give people a way to make complaints

The starting point is to ensure that your organisation gives people a way to raise a data protection complaint. The ICO’s guidance allows organisations flexibility to choose which channels are most approach, whether through a complaint form, email address, telephone number, online portal, live chat facility or in person (if operating offline).

There is no requirement to set up a separate tool for receiving data protection complaints and organisations can rely on existing complaints channels and adapt these to include data protection complaints. As per the ICO’s SAR guidance, individuals are not obliged to follow the set process and can complain using any method of their choice. Nonetheless having a set complaints process is important for accountability.

Organisations with online presence should also consider how to handle complaints received through social media and bear in mind that liaising with complainants through social media is not secure and an alternative contact method should be sought.

Those within the scope of the ICO’s Age Appropriate Design Code should satisfy the requirements for handling complaints from children outlined at standard 15 of the Code, ensuring children can easily make and escalate complaints.

Inform people of their right to complain

Organisations are already required to inform individuals of their right to submit a complaint to the Information Commissioner at the point of collection of their personal data through a privacy notice and also when responding to SARs.

Following the DUAA, organisations must now also inform individuals of their right to make a data protection complaint to the organisation itself. Organisations should update privacy notices accordingly to inform data subjects of their right to complain and the organisation’s complaints process including a contact point.

Those processing personal data for law enforcement purposes must also inform individuals of their right to complain at other junctures, including when refusing other rights requests.

Implement a complaints procedure

The ICO’s guidance makes clear that for best practice, organisations should implement a complaints procedure if they do not already have one. It should use plain language (avoid legal jargon), be published online and be made available to individuals at the earliest opportunity to ensure they are aware of how to raise complaints.

It is recommended that a written process includes the set method for receiving complaints; the supporting evidence needed to investigate; the proof of ID and third-party authority accepted as well as information on communicating timescales (acknowledgement within 30 days), updates and outcomes.

Whilst it is acceptable to integrate data protection complaints into overarching complaints procedures and a standalone process is not required, organisations must ensure outcomes are issued on data protection complaints without undue delay. So, when responding as part of a wider complaint connected to other issues, if able to provide an outcome on the data protection aspect sooner, you must do so.

Review record keeping and training

Guidance on record keeping reiterates not only the importance of having up to date, clearly organised and labelled systems so information can be found quickly and effectively, but also to provide evidence of the following:

• Date complaints were received
• Acknowledgements sent
• Relevant conversations and documents
• Complaint outcomes
• Actions taken as a result

Not only does strong record keeping support compliance with the Art.5(2) UK GDPR Accountability principle by demonstrating compliance should the ICO or other industry bodies investigate, it is also beneficial for identifying recurring trends and underlying compliance issues.

In terms of training, all staff should as part of their overall data protection training be brought up to speed on recognising data protection complaints and knowing where to direct complaints internally when received.

Review Joint Controller and Processor arrangements

For Joint Controllers, emphasis is on having transparent arrangements in place given the timescale starts as soon as the complaint is received by a Controller so all parties must be clear on what to do, including in terms of:

• whether to have a central point of contact for complaints,
• how to inform people of where to complain and
• responsibilities for investigating complaints and liaising with complaints.

Controller-Processor data processing agreements should cover arrangements for handling data protection complaints. The typical role of Processors remains to provide assistance, including on complaint investigations and by supplying relevant information, with Controllers retaining the obligation for complaint handling.

How do we ensure best practice in the end-to-end process?

Acknowledging the complaint

You must acknowledge receipt of a data protection complaint within 30 days and the ICO’s guidance clarifies that an auto-acknowledgement will suffice.

This timeframe begins the day after the complaint is received, even if this falls on a weekend or public holiday. However, if the last day to acknowledge falls on a weekend or public holiday, you have until the next working day.

A practical approach is emphasised, for instance there is no need to provide an acknowledgement and outcome separately if you are able to provide a complaint outcome within 30 days, or if contacting the complainant to ask for proof of ID an additional acknowledgement is not needed.

The same complainant ID and third-party authority verification protocols apply as for other personal data rights requests, meaning you should:

• seek proof of ID at the earliest opportunity if in doubt
• not request further evidence if already in possession of sufficient information
• verify third party authority by requesting power of attorney or a signed letter of authority from the complainant they are acting on behalf of; and
• abstain from investigating the complaint until valid authority is received.

Conducting the investigation

Organisations must make enquiries into data protection complaints without undue delay, starting from when the complaint is received and not after the 30 day acknowledgement period ends.

This process generally involves fact finding, speaking to relevant staff, comparing the complaint information with that held and checking if organisational standards were upheld, and the ICO’s guidance recommends asking the complainant for more information if necessary as well as managing their expectations.

The ICO’s guidance recognises that complaints will vary in complexity, scale and harm, meaning a blanket timeframe for resolving complaints is not expected. Instead, focus should be on the specific circumstances of the complaint (and your organisation) and making reasonable and proportionate enquiries based on this.

Providing updates and outcomes

Giving timely progress updates to complainants is emphasised in the ICO’s guidance, with the priority on explaining timeframes for resolution and any expected delays.

As with investigating complaints, outcomes must also be issued without undue delay, which according to the guidance means ‘without an unjustifiable or excessive delay.’ Outcomes should include explanation of steps taken to resolve the complaint and actions taken as a result, and where you think you have complied with data protection law this should be explained in detail.

An internal review process for complainants unhappy with the outcome is recommended. It is also best practice to inform individuals of their right to complain to the ICO, which individuals have the right to do so at any point notwithstanding any internal review process.

Conclusion

The complaints requirements introduced by the DUAA can be viewed as formalising what the ICO has long expected from organisations in terms of addressing data protection complaints. The standards emphasised in the ICO’s latest guidance on complaints largely mirrors those expected when handling other personal data rights requests.

Indeed, the ICO will be aiming for a reduction in the number of complaints brought to it following the DUAA changes. The regulator has an established policy of diverting complaints to organisations in the first instance where the issue has not previously been raised with the organisation directly, and it now has a legal basis for doing so.

This latest guidance also coincides with the ICO’s publication of its complaint handling framework which is centred on prioritising high-value cases where the ICO can have the most significant impact, an objective more realisable if less time can be spent on lower impact matters and those where internal complaints procedures have not been utilised.

Moving forward, organisations can expect to be held to a higher standard in terms of complaint handling. Not having formal procedures in place will amount to a breach of the DPA, may trigger complaints from data subjects and will be looked on with greater scrutiny by the ICO.

Implementing a formalised end-to-end data protection complaints procedure ensures best practice and will be looked on far more favourably by the ICO should any concerns be raised or investigations initiated. Data Protection People has already supported many organisations in this regard. If your organisation requires assistance in this area, please reach out to us.