▶️ You can watch all our DPPC recordings including the DPPC+ videos. Hear experts in the field answer your biggest questions on everything from AI to the changing world of FOI. 

▶️ Work in charity? We've published our draft guidance on the upcoming changes to the "charitable purpose soft opt-in". It means charities will be able to send electronic mail marketing about their charitable purposes without the recipient’s consent, as long as they meet a number of requirements.
 

▶️ We're recommending organisations look at NCSC's Cyber Action toolkit. It's packed with the government's latest cyber security advice for small businesses and aims to help protect your business from the growing threat of hackers.

▶️ We've updated sections of our Part 3 law enforcement guidance. See new sections on logging, consent and national security exemption following Data Use and Access changes.

▶️We've published the our draft data protection enforcement procedural guidance. It sets out the process we follow throughout the duration of an investigation, from opening the case and information gathering, through to reaching a decision on whether to use our statutory enforcement powers.


You can always stay up to date with our plans for new and updated guidance where you'll see what we’re developing and when we expect to publish. We’ll update this information regularly so that you can confidently track a product as it develops.

This month, I had the privilege of joining the Modernising Employment All-Party Parliamentary Group for a vital discussion on "The AI Shift: Rethinking Work, Skills and Hiring".

AI has the potential to be a powerful force for good, but if deployed without safeguards, it risks amplifying existing inequalities. And that's why one of the key messages I wanted to share during the debate was that the ICO is here to help. We want to support businesses to innovate and show how they can do this, whilst still building in the protections that are set out in data protection law.

I also highlighted how transparency and robust safeguards are critical. Automated decision making can significantly influence people’s lives, including their employment opportunities. We committed to setting out clear expectations for responsible use of automated decision making in recruitment through our AI strategy launched in June. We’ve been working closely with organisations throughout this year and will publish our findings and regulatory expectations in the new year.

Our goal is simple: to ensure automated recruitment processes are fair, transparent and trusted, while supporting growth and innovation across the economy.

What happened? 

The attack began when a malicious file was unintentionally downloaded onto an employee device on 22 March 2023. Despite a high priority security alert being raised within 10 minutes of the breach and some immediate automated action being taken, Capita did not quarantine the device for 58 hours, during which the attacker was able to exploit its systems.
 

This file enabled the deployment of malicious software onto the Capita network, allowing the hacker to stay in the system, gain administrator permissions and access other areas of the network. Between 29 and 30 March 2023, nearly one terabyte of data was exfiltrated. On 31 March 2023, ransomware was deployed onto Capita systems and the hacker reset all user passwords, preventing Capita staff from accessing their systems and network. We received at least 93 complaints in relation to this attack.