Horizon tracker
What is coming or still open across UK information law: the adequacy clock, reviews, guidance due, the regulator's sandbox and cases still running. 7 items, dated ones first in date order, then those with an expected window.
-
2026-07-30
Statutory regulatory sandbox for data protection
The regulator runs a non-statutory sandbox for products and services using personal data in innovative ways, which gives participants informal steers but no legal derogation. On 2026-07-30 it published a report finding that a statutory sandbox, one that could relax data protection requirements for a trial, is feasible only with conditions, including protecting the regulator's independence and equivalent safeguards for individual rights. It would need changes to data protection legislation, so the next step is the government's. Until then no sandbox can switch off the UK GDPR.
-
2031-12-27
EU adequacy decisions for the UK expire
Both renewed decisions (GDPR and Law Enforcement Directive) lapse unless the Commission renews them. Transfers from the EU into the UK would then need EU safeguards.
-
Recruitment ongoing at 2026-09-30
Appointment of the Information Commission chair
The Commission launched with an interim chief executive and non-executive members; the chair was still being recruited.
-
Remitted 2025-10-07
Clearview AI: remitted appeal
The Upper Tribunal restored the regulator's jurisdiction and remitted the substantive appeal to the First-tier Tribunal. Clearview indicated a further appeal. The outcome tests UK reach over foreign scraping.
-
Around the four-year mark after the 2025-12-19 renewal
Four-year review of EU adequacy for the UK
Joint Commission and EDPB review, with continuous monitoring before then. Further UK divergence is what it will look at.
-
For the government to decide, on the regulator's advice of 2026-05-05
Possible consent exception for online advertising (PECR reg 6A)
The Schedule A1 exceptions have been law since 2026-02-05, and the regulator's final guidance on storage and access technologies followed on 2026-04-29. The exceptions do not cover online advertising. In May 2026 the regulator advised the government on using regulation 6A to create an exception for some advertising purposes on publishers' own sites, such as ad delivery, measurement and fraud prevention. Until regulations are made, storage and access for advertising needs consent.
-
Rolling programme through 2026
Regulator guidance on the DUAA 2025 changes
The regulator is publishing guidance on the DUAA changes in stages. Updated international transfers guidance, built around the data protection test, came out on 2026-01-15, with further guidance on transfer risk assessments, the IDTA and cloud services to follow. Guidance on recognised legitimate interests was published on 2026-03-23. Updated research, archiving and statistics guidance and complaints guidance for organisations are on its programme.