The EU AI Act entered into force on 1 August 2024. Several provisions have been live since February 2025, and the implementation picture as of June 2026 is complex — a patchwork of live obligations, forthcoming deadlines, and a proposed renegotiation of the timeline via the Digital AI Omnibus.

What is already in force

Since 2 February 2025, the Act's prohibitions apply. Certain AI practices are banned outright: systems that manipulate individuals using subliminal techniques; social scoring by public authorities; real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions); and predictive policing based on profiling or protected characteristics. Any UK organisation deploying AI systems on the EU market falling into these categories is already non-compliant.

Since 2 August 2025, obligations for providers of General-Purpose AI (GPAI) models are live. If you are building on top of a GPAI model, or if your GPAI model is placed on the EU market, transparency documentation, copyright policy, and technical documentation requirements already apply.

The high-risk question and the Omnibus complication

The original Act required compliance with high-risk AI system obligations from 2 August 2026. High-risk systems are those used in eight sensitive categories: biometrics; critical infrastructure; education; employment and HR; essential services; law enforcement; migration and border control; and administration of justice.

In November 2025, the European Commission published the Digital AI Omnibus — a proposal to defer these obligations significantly. A provisional trilogue agreement was reached in late May 2026: standalone Annex III high-risk systems (covering recruitment, credit scoring, education, and law enforcement tools) would move to 2 December 2027, and systems embedded in regulated products to 2 August 2028. However, formal adoption is not yet complete. If the Omnibus is not enacted before 2 August 2026, the original timeline applies. Organisations cannot safely assume the deferral will land in time.

Extraterritorial reach: why this matters for UK organisations

The UK left the EU, but that does not exempt UK organisations. The regulation applies to any organisation whose AI system's output is used in the EU — regardless of where the provider is established. A UK recruitment technology firm whose software screens EU-based candidates falls squarely within scope. The UK's own domestic approach is deliberately different — a principles-based framework enforced by existing regulators including the FCA, ICO, Ofcom, and CMA. This creates a real compliance design challenge: the same AI system may face the EU Act's specific technical documentation and conformity assessment requirements in one jurisdiction, and a proportionate outcomes-based framework in the UK.

Practical steps now

The most urgent priority is AI inventory and classification. Map every AI system that touches EU individuals or the EU market, and classify each against the Act's risk tiers. Many organisations discover that systems they did not internally categorise as AI — rules-based scoring tools, automated filtering workflows, profiling engines — fall within the Act's broad definition. Documentation work is the second priority: technical documentation, records of conformity, and human oversight arrangements for high-risk systems take months to produce correctly. Start now, and update as the Omnibus timeline is confirmed.

There is a question that every senior leadership team eventually confronts: what does privacy compliance actually return on investment? For organisations willing to look beyond the compliance lens, the answer is more substantial than most expect.

The compliance trap

The dominant mental model for data protection in most organisations is defensive. Compliance is a cost of doing business, a risk to be managed, a regulator to be satisfied. The ICO's record £14 million fine against Capita in October 2025 — for security failures exposing the data of 6.6 million people — is a reminder that non-compliance carries genuine financial consequence. The Data (Use and Access) Act 2025 raises the maximum PECR penalty from £500,000 to £17.5 million. The regulatory floor is rising.

But the ceiling is what organisations miss. Privacy done well is not just risk mitigation. It is trust infrastructure — and trust, for organisations whose business depends on handling other people's data, is a source of competitive advantage that is genuinely difficult to replicate.

What the evidence shows

Organisations with mature privacy programmes consistently outperform peers on client retention, particularly in regulated sectors where procurement processes routinely include detailed privacy and data security questionnaires. A supplier that cannot produce an Article 30 Record of Processing Activities, cannot evidence its DPIA process, or cannot articulate its lawful basis for proposed processing, is increasingly unlikely to win the contract.

This is particularly pronounced in financial services, healthcare, and professional services — sectors where clients carry liability for their supply chain's data handling. The AI dimension amplifies this dynamic: as organisations deploy AI systems that process personal data at scale, whether those systems are governed properly is becoming standard due diligence in M&A, partnership, and enterprise procurement contexts.

The three components of privacy advantage

Trust as a sales asset. Organisations that can credibly demonstrate their privacy governance — through evidenced programmes, independent audit, and transparent practice — win business that competitors lose. Customers take privacy more seriously than you might expect — brands should too. Up to 49% of customers will switch away from their first-choice brand to their second-choice brand because of a better privacy experience. (Customers want control over their data — and won’t hesitate to switch brands to get it, Google, 2023). Getting privacy governance right is a particularly powerful tool.

Operational efficiency. A privacy programme properly embedded in the organisation's processes reduces the cost of compliance over time. DPIAs conducted early in product development are orders of magnitude cheaper than privacy remediation conducted after launch. A well-maintained RoPA means subject access requests can be fulfilled accurately and efficiently, rather than triggering a crisis search across multiple systems.

Resilience under scrutiny. The ICO's 2025 enforcement posture shifted markedly towards serious UK GDPR security failures. Organisations with documented security measures, tested incident response plans, and clear accountability structures consistently achieve materially better regulatory outcomes when something goes wrong. The Capita fine was reduced from a proposed £45 million to £14 million, in significant part because of cooperation and remediation. Having a tested incident response plan — and a trusted adviser who can guide you through notification decisions quickly — is one of the highest-return investments in your compliance programme.

Building towards the ceiling

The transition from compliance-floor to trust-ceiling requires a governance decision, not just a technical one. It requires leadership teams to reframe privacy from a legal function to a strategic capability — one that is resourced, measured, and connected to the organisation's broader business objectives. Practically, this means investing in a Data Protection Officer or privacy lead with genuine seniority and board access. It means conducting an honest assessment of the current programme to understand where the real gaps are and what they cost to address. And it means making privacy legible to clients and partners through clear, honest communication about what data is collected, why, and how it is protected.

Subject Access Requests are, on paper, one of the more straightforward obligations in UK data protection law. In practice, they are among the most operationally disruptive — particularly for organisations that have never designed a process to handle them at scale.

The problem with most SAR processes

The majority of organisations handle SARs reactively. A request arrives — often through a general inbox, or via a member of staff who does not recognise it as a formal SAR — and is escalated to whoever is perceived to own data protection. From there, the process typically involves an informal search across whatever systems that individual can access, followed by a manual review and a response that may not be complete, accurate, or on time.

The Data (Use and Access) Act 2025, in force from February 2026, introduces an important clarification: organisations are only required to make reasonable and proportionate searches when responding to SARs. This codifies existing good ICO guidance, but changes the practical calculus. The question shifts from "have we checked every system?" to "have we conducted a reasonable and proportionate search, and can we evidence that?"

A case study in rebuild

A professional services firm of approximately 400 people approached Halo after receiving an ICO complaint from a former employee who had submitted a SAR nine weeks earlier and received no response. The firm had no defined SAR process. The six-week rebuild focused on four elements: a single point of entry with auto-acknowledgement confirming the statutory deadline; a triage protocol establishing who receives, searches, and signs off each request; a system map identifying every repository that might hold relevant data and the person responsible for searching each; and response templates covering the most common scenarios, with appropriate redactions and exemptions documented. The rebuilt process also incorporated the stop-the-clock mechanism under the DUAA — pausing the response clock while awaiting clarification from the requester about a complex or wide-ranging request.

What a good SAR process looks like in 2026

A well-designed SAR process is documented, practised, and tested. It starts with a clear intake mechanism, assigns responsibility at each stage, maintains a log evidencing the search conducted and decisions made, and produces responses that are accurate, complete to the extent of a reasonable and proportionate search, and delivered within the statutory period. The log is critical. When the ICO investigates a SAR complaint — one of the most common triggers for ICO engagement with controllers — the first thing it asks for is evidence of the organisation's response process. A clear, time-stamped log showing when the request was received, what was searched, what was found, and when the response was dispatched is your primary defence against an adverse finding.

Article 28 of the UK GDPR is clear: where a controller engages a processor to handle personal data on its behalf, the controller remains legally responsible for ensuring the processing complies with the law. The processor agreement does not transfer that responsibility — it only creates a contractual right of recourse if something goes wrong.

Where most organisations stop

Most organisations treat vendor data protection compliance as a procurement-stage exercise. A questionnaire is completed — or a pre-completed SOC 2 report or ISO 27001 certificate is provided — and the question is considered answered. The processor agreement is signed. The data starts flowing. The relationship is reviewed, if at all, when the contract comes up for renewal.

This approach is structurally insufficient — and became materially riskier in 2025. The ICO's record fine of £45 million against Capita (although it was later reduced to £14 million) arose from a cyber-attack on a processor handling data on behalf of numerous controllers. The Capita breach is the paradigm case: a processor failure creating regulatory exposure for controllers who had no direct involvement in the incident, but who were responsible for ensuring the processor's security measures were adequate.

The DPIA question that organisations miss

When organisations conduct a DPIA for a new processing activity involving a third-party processor, they typically assess the risk of the processing itself. They less frequently assess the risk that the processor's own governance, security architecture, and subprocessor arrangements introduce. The questions worth asking are operational, not just contractual: Where, specifically, is the data stored? What are the security controls at that infrastructure layer? Who are the vendor's own subprocessors — and have you, as the controller, authorised each of them as required under Article 28(2)? What is the vendor's contractual obligation to notify you in the event of a breach? What happens to the data when the contract ends?

Continuous monitoring, not point-in-time assessment

The most significant gap in most vendor risk programmes is temporal. A security questionnaire completed at procurement reflects the vendor's posture on the day it was completed. Twelve months later — after personnel changes, infrastructure migrations, or their own supply chain incidents — that assessment may be materially out of date. The EDPB's April 2025 guidance on large language model deployments crystallised a specific instance of this broader problem: controllers engaging third-party LLM providers must conduct continuous assessments, because the processing landscape changes with model updates and platform changes. For most controllers, continuous monitoring means a proportionate schedule of review combined with contractual triggers requiring vendors to notify you of material changes to their subprocessor arrangements, security architecture, or any incidents affecting your data.

The ICO's 2025 enforcement record is instructive not because it produced the largest number of fines in the regulator's history — it did not — but because of what the fines were for. The composition of penalties shifted dramatically, and the direction of travel in 2026 is likely to continue.

The numbers

In 2024, UK GDPR breaches accounted for one sixth of all monetary penalties issued by the ICO. In the first half of 2025, that proportion rose to two thirds. The ICO issued six UK GDPR monetary penalty notices in 2025, totalling over £20 million — compared to an average of approximately £380,000 per fine in 2024, rising to just under £3 million per fine in 2025.

The headline case was Capita Group, fined £14 million in October 2025 for the cyber attack that exposed the personal data of 6.6 million individuals across multiple public sector clients. The original proposed fine was £45 million; the reduction reflected Capita's early settlement, cooperation with the ICO investigation, and remediation steps taken. Other significant 2025 enforcement included Advanced Computer Software (£3.07 million), 23andMe (£2.31 million), LastPass (£1.23 million), and DPP Law (£60,000) — all arising from security incidents.

The theme: security failures

The pattern is clear. Every significant 2025 GDPR fine arose from a security incident. The ICO is prioritising Article 32 obligations — the requirement for appropriate technical and organisational security measures — over PECR marketing and cookie consent violations that dominated enforcement in earlier years. The Data (Use and Access) Act 2025 raises the maximum PECR fine to £17.5 million, aligning it with UK GDPR maximums. The ICO's national cookies compliance check expanded to the top 1,000 UK websites in January 2025 but has so far produced corrective letters rather than fines. The warning is explicit: organisations that do not address non-compliant consent mechanisms risk escalation.

What this means for your programme

Before an incident: the ICO consistently finds that organisations subject to significant fines had identified the vulnerability that was exploited but had not remediated it. In the Capita case, unpatched systems and inadequate multi-factor authentication were known weaknesses. Article 32 requires not just security measures, but measures appropriate to the risk — which requires regular risk assessment, not a one-time implementation.

When an incident occurs: the difference between a £45 million proposed fine and a £14 million settled fine is, in significant part, about cooperation, transparency, and demonstrated remediation. Organisations that engage constructively with the ICO, notify promptly, and implement meaningful corrective action consistently achieve better outcomes. Having a tested incident response plan and a trusted adviser who can guide you through notification decisions quickly is one of the highest-return investments in your compliance programme.

Legitimate interests under Article 6(1)(f) of the UK GDPR has always been the most flexible lawful basis — and the most frequently misunderstood. The Data (Use and Access) Act 2025, now in force in stages through 2026, introduces significant changes that every data protection practitioner needs to understand.

The pre-DUAA position

Under the original UK GDPR framework, relying on legitimate interests required a three-part Legitimate Interests Assessment: identifying the legitimate interest being pursued; establishing that the processing is necessary for that purpose; and conducting a balancing test weighing the controller's interests against the rights and freedoms of the data subjects affected. The balancing test required genuine substantive analysis — evidenced in writing, and capable of being produced to the regulator if challenged.

What the DUAA introduced: recognised legitimate interests

The most significant change is the concept of recognised legitimate interests — a specific list of processing activities for which the balancing test is not required. The recognised legitimate interests currently specified include: processing necessary for national security, public security and defence; processing necessary for the detection, investigation or prevention of crime; responding to requests from bodies acting in the public interest; and processing necessary for the safeguarding of vulnerable individuals. The DUAA also codifies that direct marketing can constitute a legitimate interest.

The ICO published new guidance on recognised legitimate interests on 23 March 2026. The guidance emphasises that even where the balancing test is removed, controllers must still assess whether the processing is necessary for the recognised purpose. It draws a clear distinction between the new recognised legitimate interests basis and the general legitimate interests basis, which continues to require a full LIA.

Automated decision-making and the DUAA

The DUAA also amends the UK GDPR's automated decision-making provisions. Legitimate interests can now be used as a lawful basis for solely automated decisions that produce significant effects on individuals, provided they do not involve special category data and appropriate safeguards are implemented — including informing individuals about the decision and providing a right to challenge it. This is a meaningful change for organisations operating AI-driven decisioning systems in credit assessment, targeted marketing, and customer risk scoring.

Practical implications

If you currently rely on legitimate interests for any processing activity, your Article 30 RoPA and associated LIAs need to be reviewed in light of the DUAA changes. For activities that fall within a recognised legitimate interest, you may be able to simplify your documentation — removing the balancing test record whilst retaining the necessity assessment. Continuing to conduct unnecessary balancing tests for recognised legitimate interests is inefficient; but relying on recognised legitimate interests for processing that does not actually qualify creates a lawful basis gap that could be exposed in an ICO investigation or data subject challenge.

Article 38(3) of the UK GDPR is explicit: the Data Protection Officer must report to the highest management level of the controller. It is a short sentence. Its implications for how organisations structure their privacy governance are more significant than most realise.

What independence actually requires

The independence requirement exists because the DPO's primary obligation is to the law — not to the organisation's commercial interests, and not to the function that employs them. A DPO who reports to the General Counsel is supervised by a legal function that has its own conflicts of interest: the GC advises the business on how to achieve its commercial objectives, and may face internal pressure to facilitate processing that the DPO would otherwise advise against. The ICO's guidance is unambiguous: the DPO must report directly to the highest level of management — typically the board, the CEO, or the equivalent executive body. Failure to provide appropriate organisational positioning for the DPO is itself a breach of Article 38.

The governance reality

In practice, most organisations that appoint a DPO position them as a senior function within legal, compliance, or IT. The consequence is predictable: when there is a tension between commercial objectives and privacy obligations, the DPO's advice is weighed against the commercial interest by the function they report to, rather than being escalated directly to the board for decision. This structural subordination creates a governance environment in which privacy decisions are made below the level at which they should be made — and in which the DPO's independence is compromised before they have said anything.

What effective board-level reporting looks like

Effective DPO reporting to the board means the DPO attending at least quarterly board or audit committee meetings as a standing item, with a report covering: the current state of the data protection programme; any significant new processing activities; outstanding DPIA actions; any ICO correspondence; data subject request volumes and timeliness; and any incidents or near-misses in the period. The board should be able to ask questions and receive direct answers — not via an intermediary function.

Organisations that get this right find that board engagement improves the quality of the privacy programme. When board members understand what the DPO does and why it matters, they are more likely to prioritise the budget, the headcount, and the organisational changes needed to do it well. The DPO's effectiveness is, in this sense, directly correlated with their structural positioning.

International data transfers remain one of the most operationally complex areas of data protection compliance. The landscape in 2026 is materially different from 2018, and different again from 2022. Understanding where the law currently stands requires attention to three distinct frameworks: the UK position, the EU position, and the interaction between them.

The UK framework after the DUAA

The Data (Use and Access) Act 2025 codified the UK's risk-based, outcomes-focused approach to adequacy assessments, replacing the EU's test of essential equivalence with a new threshold: the third country must offer data protection safeguards not materially lower than those available in the UK. This is a deliberate liberalisation. In practice, the UK retains adequacy decisions for the EU, EEA, and a list of countries including the US via the UK–US Data Bridge, in force since October 2023. For transfers to countries without UK adequacy, International Data Transfer Agreements (IDTAs) remain the primary mechanism.

The EU-US Data Privacy Framework

The EU-US Data Privacy Framework (DPF) was upheld by the EU General Court in September 2025, following a legal challenge. The court found that the DPF's redress mechanism provides meaningful judicial redress for EU individuals — a significant decision providing medium-term stability for organisations relying on the DPF for EU-US transfers. However, experienced practitioners continue to maintain Standard Contractual Clauses as a backup alongside DPF reliance. The DPF remains politically exposed, and DPF certification covers only specific types of processing by certified US organisations — many US vendors are not DPF certified, and SCCs remain necessary for transfers to them.

Transfer Impact Assessments in 2026

Transfer Impact Assessments (TIAs) remain a live obligation for organisations relying on SCCs or IDTAs. The most common TIA gap in 2026 is not in the initial assessment but in maintenance. A TIA conducted two years ago may be materially out of date given changes in US privacy law, the DPF General Court judgment, and updates to EDPB guidance. The DUAA commencement regulations of February 2026 require organisations to refresh TIAs to reflect the new 'not materially lower' standard. The practical message: audit your international transfer inventory, confirm which mechanism covers each transfer, verify that your processors and sub-processors are covered, and ensure your TIAs are current.