You have received this email as example@emailaddress.test is currently subscribed to receive ICO communications.

Click to unsubscribe
 

In 2026, we will be changing newsletter provider and will be asking subscribers to reconsent to this newsletter. 

If you don't receive a newsletter in January - head to ico.org.uk/newsletter to subscribe.

Welcome to the ICO's December 2025 e-newsletter
 
 
A photo of John Edwards. John is wearing a smart blue suit with a blue striped tie. The text reads: "John Edwards, Information Commissioner"

Hello – and welcome to the December newsletter.

From my first day in this job, and every day since, one question has always been in the front of my mind: “How does the ICO have the greatest impact?” It’s a question I hear from the Science Innovation and Technology Committee, from leaders across the sector and in meetings with colleagues at the ICO. And as we plan for the next year, it’s a question that will shape our new strategy and how we embrace, and best give effect to, changes coming as a result of the Data Use and Access Act.

For the public we protect, impact means our work should give them confidence that their personal information is handled responsibly. As a regulator, sometimes we need to intervene directly with organisations to drive change. But this is not the only way we can have impact. This can mean providing advice on specific queries, acting on complaints, undertaking audits and conducting investigations and taking enforcement steps like issuing reprimands, enforcement orders and monetary penalties. In choosing how to respond to a particular issue, our goal is to raise standards across entire sectors. That means choosing the right regulatory tools to hold decision-makers accountable, set clear expectations, and secure lasting improvements.
 
For the data protection community, impact means ensuring we provide certainty and support. This comes from our guidance, our communications and our direct work with sectors. You’ll see this reflected in this month’s updates: a reprimand issued to the Post Office for an avoidable data breach with practical lessons for all organisations, guidance to support information sharing to safeguard children in the education sector and progress on our cookie compliance work, where we’ve looked to several of the tools in our regulatory box to make significant improvements.

And for innovators and developers, impact means our work enables progress without compromising rights. Our Sandbox project gives us the chance to see this impact up close. West Yorkshire Police recently explored how machine learning can support domestic abuse risk assessments.

Above all, impact means regulating for outcomes with real impact, and not outputs that might be easy to count but don’t improve people’s lives. That means using the right tools at the right time, raising standards across sectors and building trust in a digital world. That’s the measure of success we’ll carry into 2026.

I’ll end the year with a note of thanks. Thank you to my colleagues within the ICO. Thanks to our partners who support so much of our work. And thank you to you, the practitioners who are the link between the theoretical protections and opportunities of the law and the real impact it has on people’s lives.

John.

Latest news from the ICO
Circles and triangles
Circles and triangles
Circles and triangles
Circles and triangles
A news icon

▶️ We’ve released our findings from two Sandbox projects:

Eclipse Digital Solutions and Geutebruck (UK)’s AI and IoT tech is designed to predict falls and monitor health in social care. We looked at how organisations deploying Visual Intelligence act as controllers, joint controllers or processors.

West Yorkshire Police explored a machine learning-based Domestic Abuse Assessment Tool to identify high-risk cases, and we assessed how data protection principles apply when sharing sensitive information across agencies.

▶️ We've set out our public sector approach. Following your feedback, we've added a clearer definition of organisations in scope and the circumstances under which a fine may be issued. 


▶️ We're launching a monitoring programme targeting 10 popular mobile games played by children in the UK. We'll be scrutinising how these companies protect children's online privacy and meet our standards. 

▶️ Our action to tackle cookie compliance has brought the vast majority of the UK’s most used websites into compliance with rules on the use of advertising cookies. Hear from Tim Capel, ICO Interim Executive Director of Regulatory Supervision in our latest update on this work.

New and updated guidance

▶️ Our new guidance aims to help people who work in the education sector with children and young people under 18. It should help you feel confident to share personal information for safeguarding purposes.

You can always stay up to date with our plans for new and updated guidance where you'll see what we’re developing and when we expect to publish. We’ll update this information regularly so that you can confidently track a product as it develops.
Emily Keaney



Director's Update

Emily Keaney 

Since we introduced the Children’s code, we’ve been working to ensure the internet is a privacy-friendly, safe space for children. Over the past year, that's meant looking closely at how social media and video-sharing platforms collect and use children’s data.

I believe online services should innovate and grow, but not at the expense of children’s safety. Designing apps and websites with the best interests of young people in mind is essential. Parents and guardians deserve peace of mind about what happens to their children’s personal information online.

So what have we achieved since our March 2025 update?

  • Secured improvements or confirmed good practice to 10 platforms’ approach to children’s privacy settings. This includes Twitch, Viber and Hoop; from private profiles by default to just-in-time privacy notices and restricted visibility for child users.
  • Engaged with Snap and Meta on how they process children’s geolocation data, particularly around Map functions on Snapchat and Instagram.
  • Issued notices of intent for penalties to MediaLab (Imgur) and Reddit following investigations into their handling of UK children’s data and age assurance measures.
  • Reviewed age assurance practices on 17 popular platforms, including Discord, Pinterest and X, and launched a monitoring programme to drive stronger, proportionate age checks on high-risk services.

These changes have already reached over three million children, with the potential to improve online privacy for up to 11.7 million across the UK.

There’s still more to do, but every step brings us closer to an internet where children can explore, learn and connect safely. You can read more about our work in our strategy update. 

Action we've taken
Lessons from the Post Office's web publishing failures: why strong processes matter

❓ What happened?

The Post Office’s communications team mistakenly published an unredacted legal document on its website. The document contained the names and home addresses of 502 people. The breach went unnoticed for nearly two months before removal. Our investigation found insufficient technical and organisational measures, including missing documented procedures and quality assurance checks.
A lightbulb
A lightbulb

💡 What can organisations learn from this case?

Establish clear publication protocols: Sensitive documents should go through a formal review and approval process before being published online. A multi-step sign-off process can help prevent errors.

Understand the data you handle: Every team, especially those handling public-facing content, must be trained to recognise personal information and assess its sensitivity in context. This includes understanding the reputational and emotional impact of disclosure.

Centralise and classify documents: Use secure, shared repositories with clear access controls and classification labels. Avoid reliance on personal storage systems such as OneDrive and Google Drive.

Define roles and responsibilities: Ensure that everyone involved in publishing content understands their role and the checks required before publication.

Tailor training to the task: General data protection training is not enough. Teams need specific guidance on publishing protocols, data classification, and risk awareness.

Read more about the case and our advice.


 
  • London Borough of Enfield Council issued with an enforcement notice for failures under the FOIA. We've ordered them to log all FOI requests within three months and clear overdue cases within six.
  • Our enquiries revealed that Cambridge Hospitals NHS Trust had compliance rates as low as 14%. We've issued an enforcement notice and instructed that they must address the backlog.
  • We found that London Borough of Redbridge Council had consistently poor FOI response performance levels and significant numbers of overdue requests. We've issued a practice recommendation and instructed them to create an action plan to achieve 90% timeliness and clear backlog by March 2026.

Get involved with the ICO
Event icon
Event icon
Event icon
Event icon

📢 We're looking for your input on our latest guidance, frameworks and policy positions - it's part of our commitment to create practical advice that works for you.

🚨 Closing this month: 


🚨 Still have time

  
job icon

What's it like working at the ICO

At the ICO, we're commited to creating a workplace where everyone feels seen, supported and able to truly be themselves at work. 

As a new member of Women in Data, we’re expanding opportunities for women in data and tech, supporting career development and fostering an inclusive culture that values every voice. Read more about our membership and other benefits of an ICO career.

And our newly formed Men's Network marked International Men's Day with a charity walk. The network sits alongside our other established networks and aims to provide a community where men can connect, open up about issues they face, and engage more actively in equality, diversity and inclusion discussions. You can read more about the community in our recent LinkedIn post.
 
Unsubscribe
If you wish to unsubscribe, please click on the link below.
Please note this is an automated operation.
Powered by Adestra https://newsletter.ico.org.uk/u/1hxV0P2Nip