Worldwide: Privacy

The UK Information Commissioner's Office has published final guidance on a new lawful basis for processing personal data under the UK GDPR, introduced by the Data (Use and Access) Act 2025. This recognised legitimate interest basis provides five pre-approved processing purposes deemed to be in the public interest, offering organisations an alternative pathway for lawful data processing in specific circumstances.

The UK government has introduced mandatory smart data sharing obligations under the Data (Use and Access) Act 2025, targeting businesses across banking, finance, energy, property, retail, transport, telecoms, digital markets, and agrifood sectors. With regulatory powers now in place and implementation timelines accelerating toward 2027-2030, affected businesses face new compliance requirements, competition law risks, and data infrastructure challenges that demand immediate strategic assessment.

Historically, establishing corporate criminal liability in the UK was very difficult due to what is known as the ‘Identification Principle’ in English law.