ICO issues final guidance on data protection complaints ahead of DUAA deadline
On 12 February 2026, the ICO published its final guidance on handling data protection complaints under the Data (Use and Access) Act 2025 (DUAA). Much of DUAA is already in force. However, one of its key operational reforms, a new statutory obligation on companies to implement and maintain a data protection complaints process, amends and […]
How FCA whistleblowing data is quietly shaping regulatory risk
At first glance, the FCA’s Q4 2025 whistleblowing data looks like a routine quarterly update. Volumes are down. Only a small percentage of reports resulted in “significant action.” There are no blockbuster enforcement announcements that dominate the headlines. But for compliance leaders and boards, this report is not about volume. It is about how whistleblowing […]
Disney’s $2.75 million data privacy wake-up call
When The Walt Disney Company agreed to pay $2.75m to settle allegations under the California Consumer Privacy Act (CCPA), it wasn’t just another regulatory fine. It was a warning to the entire digital advertising industry. Announcing the settlement, Rob Bonta made the point noted, “Consumers shouldn’t have to go to infinity and beyond to assert […]
WhatsApp v. the EDPB: Why this €225m GDPR case matters for every business
In a significant ruling that could reshape the way GDPR fines are challenged across Europe, the Court of Justice of the European Union (CJEU) has backed WhatsApp’s right to directly challenge a €225m privacy fine imposed following intervention by the European Data Protection Board (EDPB). This may look like another Big Tech procedural battle. But […]
Is Ireland setting the pace for AI governance in 2026?
Ireland has now moved from theory to infrastructure in AI regulation. With the publication of the General Scheme of the Regulation of Artificial Intelligence Bill 2026, the Irish Government has set out how it will turn the EU AI Act from a directly applicable regulation into a functioning national enforcement system. This matters far beyond […]
Annexe I firms under fire: The FCA’s AML crackdown enters a new phase
For years, Annexe I firms have occupied the grey zone in UK financial regulation. Commercial lenders, money brokers, invoice-factoring providers, leasing companies and safety-deposit box operators are not fully authorised by the FCA, yet they sit squarely in the path of illicit finance. That grey zone is now closing. The FCA has made clear, through […]
DUAA Enters Its Next Phase. What do UK businesses need to know?
The UK’s data protection landscape has shifted. The next phase of the Data (Use and Access) Act 2025 (DUAA) is now in force, bringing with it the most substantial reforms to UK data protection since the introduction of the UK GDPR. While the Act received Royal Assent back in June 2025, many organisations have been […]
The Digital Omnibus isn’t a way to just buy time. Is Parliament rewriting the AI Act’s rules?
For months, the European Commission’s Digital Omnibus proposal was framed as a pragmatic reset. It is a way to give businesses breathing room while standards, guidance and enforcement structures caught up with the ambition of the EU AI Act. That framing is now looking very different. The European Parliament’s Committee on Legal Affairs (JURI) has […]
From client account to compliance failure: lessons from the SRA’s £68K fine
The SRA’s £68K fine against Scott-Moncrieff & Associates (ScoMo) is not just another AML enforcement headline. It is a clear reminder of how regulators are now assessing risk, intent and follow-through and of how little tolerance there is for firms that fail to adapt after being warned. That the firm was founded and run by […]