Does this change affect me right now?

It depends on the type of change and your situation. Items marked "In force" apply now. Items marked "passed but not yet in force" have been approved by Parliament but a commencement order has not yet set the start date — they cannot be enforced until that date. Check the official commencement information on legislation.gov.uk. If you are unsure how a change affects your situation, Citizens Advice offers free guidance.

Where can I read the full official text?

Every news item links to its primary source. All UK Acts of Parliament and statutory instruments are on legislation.gov.uk. Bills still going through Parliament are tracked on Parliament.uk. Court judgments are published on BAILII. If the change relates to official government guidance, that is published on GOV.UK.

Can I rely on this news item for a legal decision?

No — news items are summaries for general awareness, not legal advice. They do not take your specific circumstances into account. For decisions that carry legal or financial consequences, consult a qualified solicitor. The Law Society's Find a Solicitor tool lets you search by area of law and location. For lower-stakes questions, Citizens Advice covers most everyday situations for free.

How quickly does LawTheGuide update when a law changes?

We aim to cover significant changes — new Acts, major court rulings, statutory instruments — within a few days of publication. Our primary sources are legislation.gov.uk, Parliament.uk, BAILII, and GOV.UK. Guides are updated only when a change is confirmed in force — not when it is merely passed.

What is the difference between a law being "passed" and "in force"?

A law is "passed" when it receives Royal Assent — Parliament has approved it and it is technically an Act. It is "in force" when a commencement order sets the date it actually takes effect. Some Acts sit passed but dormant for months or years. Until it is in force, no one can rely on it or be bound by it. Commencement orders (statutory instruments) on legislation.gov.uk record the exact effective dates.

ICO publishes AI and data protection guidance for businesses using generative AI — News

The Information Commissioner's Office (ICO) published its comprehensive guidance on generative artificial intelligence and data protection in October 2026. The guidance sets out how UK GDPR and the Data Protection Act 2018 apply across the AI lifecycle — from scraping training data to deploying customer-facing AI systems.

Lawful basis for training. The ICO confirms that legitimate interests under UK GDPR Article 6(1)(f) can provide a lawful basis for processing publicly available personal data to train AI models, but only where a genuine three-part legitimate interests assessment (LIA) has been carried out. Relying on legitimate interests without a documented LIA is unlawful. Where the training data was scraped without notice to data subjects, the ICO expects businesses to provide privacy information at first contact with affected individuals.

Purpose limitation. Personal data collected for one purpose cannot be used to train an AI system for a materially different purpose without a new lawful basis. This applies to customer data, employee data, and any other personal data collected in the course of business. Pseudonymisation reduces risk but does not render data outside UK GDPR if re-identification is reasonably possible.

Automated decision-making. Where an AI system makes decisions that significantly affect individuals (for example, credit decisions, recruitment screening, or medical triage), UK GDPR Article 22 rights apply: the individual must be told a solely automated decision has been made, must be able to request human review, and must be given a meaningful explanation. The ICO's guidance on automated decision-making sets out the compliance steps. Individuals whose data is used by AI systems may exercise their rights — including the right to a copy of their data — by making a subject access request.

The ICO has published a self-assessment toolkit for AI developers and deployers on ico.org.uk. Organisations that fail to comply with UK GDPR face fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.

This item summarises a legal development for general information only. It is not legal advice. Always check the official text and, for your own situation, consult a qualified lawyer.

Questions about this item