Source: Osborne Clarke

On 15 July 2025 the UK government launched a call for evidence seeking practical examples of how personal and non-personal data regulation interacts with AI and other data‑intensive technologies, and a separate call on whether the UK’s regime enables trusted international data flows; both calls for evidence close on 9 September. The government also launched a multi‑sector call for evidence on smart data schemes following publication of a smart data strategy in March, noting targets of five or more active schemes by 2030 and 20 or more by 2035 and citing the Data (Use and Access) Act 2025 as the statutory framework enabling secondary‑legislation powers for scheme creation and governance.

The Information Commissioner’s Office has published a draft corporate strategy for consultation covering 2026–2028 with an anticipated governance transition in the autumn; the draft says the ICO will prioritise regulatory effort on highest‑risk and systemic issues, lists four priorities (protecting children; promoting trust and transparency in AI; improving public services’ use of personal data; building cyber resilience), and states an intention to increase use of AI and data analytics in regulation — that consultation closes on 23 August. Separately, the ICO reported on audits of 28 edtech providers (2024–2025) finding strengths in information security but common gaps on controller/processor roles, contract detail, data‑flow mapping, minimisation, retention, privacy information and DPIAs; the EDPB has adopted guidelines on web scraping for training generative AI, on anonymisation and on blockchain processing under the GDPR, with those guidelines open for consultation until 30 October.