News and analysis
UK GDPR compliance, Subject Access Requests (SARs), data breaches, marketing preferences, and ICO enforcement.
Topic archive
Showing 1 to 7 of 7
A wrong diagnosis, incorrect allergy, mistaken address or information belonging to another patient can remain in a medical record long after the original mistake. Patients have a right to challenge factual inaccuracies, but correcting a medical record does not
ASOS says names and contact details may have been accessed after an unauthorised notification was sent through its app. The NCSC is advising every ASOS customer to assume they are affected, while passwords and payment-card information are not currently believe
NHS England has told trusts to act immediately when staff are suspected of accessing patient records without a legitimate reason. But the crackdown raises another question: how would a patient know that somebody had looked?
The UK's data protection regulator will move from a regulator centred on one statutory office-holder to a board-led body on 30 September 2026. It will be called the Information Commission, but it will still be known as the ICO and its existing functions and re
The ICO has warned that wearable cameras make it harder to know when personal data is being captured. Data protection law does not prohibit every personal recording, but wider sharing, organisational use, biometric analysis and targeted harassment can change t
A camera, a visible screen or an objection to being filmed does not automatically create a UK GDPR breach. Here is the test the law actually applies, and where both online claims and nervous organisations go wrong.
Personal data linked to about 8.7 million customers of Manchester, London Stansted and East Midlands airports was accessed in a cyberattack. Here is what is known, what remains under investigation and the practical steps affected customers can take.