Data Protection Commission Ireland’s Post

Data Protection Reform: The Data (Use and Access) Act 2025 An Article by Dr. Rosanna Cooper and Daniella Corbin Introduction The Data (Use and Access) Act 2025 (‘DUAA’)  received Royal Assent on 19 June 2025. Parts of the UK General Data Protection Regulation (‘UK GDPR’) have been changed and/or replaced by the DUAA. The provisions of the DUAA have been brought into force in stages since. Most of the data protection provisions took effect on 5 February 2026. The new complaints regime took effect on 19 June 2026.

As insurers increasingly rely on digital tools and automated processes, legal certainty is becoming increasingly important.   Yet when it comes to GDPR and automated decision-making, the rules are still interpreted differently, and often restrictively, across EU Member States.   For insurers operating across the Single Market, this creates unnecessary complexity and an uneven regulatory landscape.   The European Commission Digital Omnibus proposal offers an opportunity to address these differences through targeted EU-level clarifications, particularly on when insurers can rely on the contractual exception under Article 22 GDPR.   Clearer rules would help ensure a more consistent application of the GDPR, support harmonised enforcement across the EU, and provide insurers with the legal certainty they need to innovate and operate efficiently.   Want to know more about our recommendations? Scan the QR code below to read our paper. Learn more here: https://lnkd.in/e_7_NAX5

Keeping up with the latest UK data protection changes ❓ The Information Commissioner’s Office (ICO) transitioned to the Information Commission (IC) on 30 September, under the new governance arrangements introduced by the Data (Use and Access) Act 2025. To help you navigate these changes, we’ve updated our Keeling Schedules to reflect the latest amendments. Our Keeling Schedules provide a clear, practical view of how the Data (Use and Access) Act 2025 amends: 📌UK GDPR 📌Data Protection Act 2018 📌Privacy and Electronic Communications (EC Directive) Regulations Explore the updated Keeling Schedules and see exactly how the legislation has changed here 👉 https://lnkd.in/d6veSWtK #PrivacyLaw #DUAA #DataProtection #LegalUpdate #ICO

This one will not improve your life. Article 2(1) of the UK GDPR covers paper records only where they form part of a filing system, or are intended to. A sticky note with a customer's name on it, loose on a desk, sits outside that. The same note in a folder sits inside it. Tidying up is, legally, an event. We think about this more than is healthy. Worth knowing what is in your filing system, and what no longer needs to be: https://www.evastore.co.uk

One global strategy. Multiple regulatory realities. As companies expand into new markets, one challenge quickly becomes clear: regulatory frameworks may share common principles, but they are rarely identical. The GDPR has influenced data protection laws around the world, including Brazil’s LGPD. But each jurisdiction has developed its own requirements and specificities. For international organisations, understanding these differences is essential. Because global compliance is not about applying one approach everywhere. It is about adapting to the rules that apply in each market. One common requirement across several jurisdictions: appointing a local representative. At EDPO, we provide representative services in the EU, UK, Switzerland and Monaco to help organisations meet these local obligations.

Session replay is legal with consent, masking and disclosure, and a liability without them. What GDPR, ePrivacy and US wiretap suits require.

CIPP/E: before you book A precise reading of the GDPR. The right answer applies the correct article, role or lawful basis to the facts given, not the option that simply sounds most protective. The exam: 90 questions in 150 minutes, pass mark 300 on a 100 to 500 scale. Heaviest domain: European Data Protection Law and Regulation, 18 to 28 questions. Find out where you stand before you pay the fee. https://lnkd.in/erjH4JNt Preparing for an exam? Join free as an Associate Member for the readiness check and pathway: https://lnkd.in/enWYntYY #CertificationPrep #DigitalTrust

US companies facing GDPR Article 15 requests must balance transparency with protecting trade secrets. While GDPR requires providing personal data and processing info, revealing too much risks exposing proprietary information. Courts say companies must give meaningful explanations without disclosing core trade secrets. A strategic, layered approach—such as internal systems for calibrated disclosures and clear documentation—is essential.

A common misconception: people think if theyre already GDPR compliant, theyre automatically DPDP compliant too. Theyre not the same law. DPDP doesnt have GDPRs broad legitimate interest basis — Section 7 gives a fixed, narrower list of allowed uses instead. A lot of GDPR-style processing needs a fresh look, not just a relabel. Same spirit, different rules.

Sol 6.1 struggles with writing GDPR compliant text that is accurate and sounds trustworthy. Don't believe Opus 5.5 would do any better. Do others feel that you need a real frontier model (e.g. Astra or Fable) for combining different points-of-views? 🤔