Does this change affect me right now?

It depends on the type of change and your situation. Items marked "In force" apply now. Items marked "passed but not yet in force" have been approved by Parliament but a commencement order has not yet set the start date — they cannot be enforced until that date. Check the official commencement information on legislation.gov.uk. If you are unsure how a change affects your situation, Citizens Advice offers free guidance.

Where can I read the full official text?

Every news item links to its primary source. All UK Acts of Parliament and statutory instruments are on legislation.gov.uk. Bills still going through Parliament are tracked on Parliament.uk. Court judgments are published on BAILII. If the change relates to official government guidance, that is published on GOV.UK.

Can I rely on this news item for a legal decision?

No — news items are summaries for general awareness, not legal advice. They do not take your specific circumstances into account. For decisions that carry legal or financial consequences, consult a qualified solicitor. The Law Society's Find a Solicitor tool lets you search by area of law and location. For lower-stakes questions, Citizens Advice covers most everyday situations for free.

How quickly does LawTheGuide update when a law changes?

We aim to cover significant changes — new Acts, major court rulings, statutory instruments — within a few days of publication. Our primary sources are legislation.gov.uk, Parliament.uk, BAILII, and GOV.UK. Guides are updated only when a change is confirmed in force — not when it is merely passed.

What is the difference between a law being "passed" and "in force"?

A law is "passed" when it receives Royal Assent — Parliament has approved it and it is technically an Act. It is "in force" when a commencement order sets the date it actually takes effect. Some Acts sit passed but dormant for months or years. Until it is in force, no one can rely on it or be bound by it. Commencement orders (statutory instruments) on legislation.gov.uk record the exact effective dates.

ICO issues record £12.5 million fine for failing to secure customer data — News

The Information Commissioner's Office (ICO) issued a £12.5 million monetary penalty notice in October 2026 against a retail company that failed to implement adequate technical measures to protect customer payment card data. The ICO found that the company stored card numbers, expiry dates and CVV codes in plaintext databases for more than three years — a breach of Article 5(1)(f) and Article 32 of UK GDPR (Data Protection Act 2018).

The penalty is the highest issued by the ICO since the UK GDPR came into force. The Commissioner stated that storing payment credentials in plaintext is an "elementary failure" given published industry standards such as the PCI DSS framework. The company had a contractual obligation under the standard to encrypt cardholder data at rest and in transit — and did neither.

The ICO has published security guidance under UK GDPR setting out the technical and organisational measures required. Any organisation that collects, processes or stores personal data should conduct a data mapping exercise and review its encryption practices. Individuals affected by a data breach have the right to complain to the ICO at ico.org.uk/make-a-complaint and may have a claim for compensation under section 168 of the Data Protection Act 2018.

This item summarises a legal development for general information only. It is not legal advice. Always check the official text and, for your own situation, consult a qualified lawyer.

Questions about this item