Package of measures unveiled to drive economic growth

The SME Data Essentials training and assurance programme launching later this year will provide free training to small businesses on compliance with data protection law. The training will improve compliance and save costs, helping them grow their business while also strengthening trust with their customers.

We believe this will boost business confidence to exploit the full potential of the data they hold in a responsible way. Based on evidence from the evaluation of the pilot, 85% of organisations reported increased knowledge of data protection, while 96% reported feeling more confident in dealing with data protection issues.

The ICO will pilot an experimentation regime designed to enable businesses to trial innovative data-driven solutions within a controlled regulatory environment.

Under the scheme, organisations will be granted comfort from enforcement of certain data protection requirements, starting with consent rules for privacy-preserving advertising models.

This initiative, modelled on frameworks in Japan and South Korea, will provide insights into how regulation can adapt to technological change.

Findings from these experiments may guide future regulatory reforms, ensuring that the UK’s regulatory framework remains fit for purpose in a fast-evolving digital economy.

This initiative builds on the success of the ICO’s Regulatory Sandbox and Innovation Advice services and ensures that data protection law evolves as technology advances.

Legislative change will be required to enable the ICO to provide full legal comfort to organisations. The government will consider the case for legislative change following the ICO’s pilot.

The ICO will introduce simpler guidance for businesses developing or deploying AI, ensuring clarity of what the data protection law. This will enable organisations to unleash the opportunities of this technology while still safeguarding people’s personal data.

The new framework will guide AI adoption in both private and public sectors, fostering technological advancement and public trust.

The ICO will further support the government in embedding these regulations into a statutory code of practice, ensuring lasting certainty for AI-driven growth.

The ICO is reviewing the Privacy and Electronic Communications Regulations (PECR) consent requirements to enable a shift towards privacy-preserving online advertising models.

Currently, all profitable digital advertising requires user consent under PECR, even where some activities, delivered in certain ways, can have minimal privacy impact. Because behavioural advertising, which involves tracking and profiling users, is considered to be most profitable, there is no incentive for businesses to adopt less intrusive advertising techniques as the same regulatory burden applies in all cases.

To address this, the ICO will develop a position on the processing activities critical for delivering and measuring privacy-preserving advertising and assess their regulatory status under PECR where the PECR consent requirements could be relaxed.

This autumn, the ICO will publish a statement identifying low-risk advertising activities which in our view are unlikely to cause harm or trigger enforcement action. We will consider safeguards we would expect to reduce risks to users and devices. The aim is to provide legal clarity for businesses while safeguarding user privacy.

This work will support the government in developing planned secondary legislation to amend PECR consent requirements, creating an exemption for specific low-risk advertising purposes. This would make privacy-friendly advertising models more commercially viable, boosting business growth while enhancing consumer privacy.

International transfers of data underpin around 40 per cent of UK exports and 20 per cent of imports. These flows of data provide UK businesses with access to new markets and partners which can boost trade and drive innovation, investment, competition and growth. 

To facilitate this, we will publish new and updated guidance on international data transfers, making it quicker and easier for businesses to transfer data safely. We will work through international fora, including the G7 and the Global Privacy Assembly, to build international agreement on increasing mechanisms for trusted free flows of data, and we will work with government to review adequacy assessments for key trading partners. 

These commitments complement our existing and evolving suite of products and services that support international data transfers. These include the UK binding corporate rules (BCR) addendum, which has transformed the process for approving BCR applications and made it faster and more efficient for businesses to transfer data.

• The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
• The  ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
• The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
• To report a concern to the ICO telephone call our helpline on 0303 123 1113, or go to ico.org.uk/concerns.