Information Commission's Office

Our free Data Protection Essentials training course provides straightforward, practical online training to help smaller organisations boost their business fitness by better understanding their data protection responsibilities and apply them confidently in their everyday work. 📢 Don't just take our word for it Department for the Economy NI, Minister Dr Caoimhe Archibald, has encouraged small businesses and sole traders across Northern Ireland to take advantage of the training: “Good data protection is an important part of doing business responsibly and maintaining the trust of customers, staff and the wider public. “For smaller businesses, finding the time and expertise to navigate data protection requirements can be challenging. This free training provides practical, accessible support that can help businesses protect personal information, reduce risk and build confidence. “I would encourage small businesses and sole traders across the north to take advantage of this resource and strengthen their data protection knowledge and skills.” 👉 Register today and see why so many Ministers and organisations recommend it: https://brnw.ch/21x6Ozb

We all know the classic Halloween villains: Ghostface, Michael Myers, Freddy Kreuger, but who’s the real villain in a DPO’s life? Here are some of the villains who are sure to appear in your haunted house: 👻 That colleague who downloads new software and THEN asks you to do a DPIA. Read through our DPIA guidance for some advice: https://lnkd.in/eKWJ2VDh 🧛 That person in the office who goes to make a cup of tea without locking their screen. Send them our guidance on keeping IT systems safe: https://lnkd.in/eZN6WKHF 🧟♀️ Your aunt who has all of her passwords written on post-it notes that are stuck to her monitor. 🎃 The one member of staff who doesn’t do their data protection training and fails the phishing email test. Send them our free Data Protection Essentials training before your next training reminder: https://lnkd.in/eXSjMZEj 🦇 That person who accidentally used CC instead of BCC. 🕷️ Lastly, that one member of your team who asks a ‘quick question’ at 4:50pm on a Friday. What other horror stories have we missed? Comment below what would be in your haunted house and happy Halloween!

We're committed to working with other regulators, the Digital Regulation Cooperation Forum (DRCF) and Government to identify potential gaps in Agentic AI compliance, protect the public from heightened risks and hold developers and adopters accountable where the technology infringes on people's rights.    We've issued a joint statement with our fellow regulators on the DRCF's website: https://lnkd.in/e4u2MFBE   We are seeking your views and expertise on our Agentic AI guidance via a consultation which is open until 20 November. Whether you're building agentic systems, integrating them into products, advising clients or governing their use, we'd like to hear about your experiences: https://lnkd.in/evWA-gK4

🆕 We’ve published our updated guidance on special category data and two new interactive tools. 📍 What UK organisations need to know Special category data is important under data protection law. This type of information is particularly sensitive and there’s a greater risk of harm if it’s not handled correctly and so, it’s important that organisations get it right. 📍 Key changes We’ve updated the guidance to reflect changes under the Data (Use and Access) Act, and to make the text clearer. At times organisations can find it challenging to identify which condition they can rely upon to process special category data – so we’ve created two new interactive tools to make it easier to get this right; one for working out what article 9 condition might apply and one for deciding DPA substantial public interest condition might apply. 📍 Next steps for organisations Read the updated guidance: https://lnkd.in/eAgZPaZt Try our new tool to help you work through the article 9 conditions for handling special category data: https://lnkd.in/eEsaKat6

NEW: In response to Ofcom's new rapid assessment of highly effective age assurance at the 16-age threshold and app store report, Katie Searle our Director of Children's Strategy said: “We welcome Ofcom's rapid assessment of highly effective age assurance at the 16-age threshold and its app store report published today. “Age assurance plays an important role in the ICO and Ofcom's shared goal of protecting children from harm online. However, it must be implemented in a way that keeps people's personal information safe and allows them to exercise their information rights. “We are working closely with Government and Ofcom, to ensure that data protection is considered as the new regulations are developed. This also complements our own work assessing how age assurance providers currently comply with data protection law. "Social media and video-sharing platforms should already be putting in place appropriate age gates to ensure users under their current minimum ages – usually 13 - are not exposed to risks arising from the unlawful processing of their information. "We urge all social media and video-sharing platforms to act now to protect underage users from harm.”

NEW: Lessons your organisation can learn from our action against Staffordshire Police. ❓ What happened? In March 2024 Staffordshire Police issued a Domestic Violence Protection Notice, which is an emergency measure intended to protect a victim from violence or threats of violence. The notice was served on the alleged perpetrator following their release from prison and unlawfully included the victim’s address, which was not previously known to the alleged abuser. This data breach caused serious distress to the victim, who had previously moved home on several occasions to escape the alleged abuse. Our investigation also found that Staffordshire Police failed to have appropriate measures in place to prevent an unauthorised disclosure, including poor completion rates for mandatory training in both data protection and issuing DVPNs. View all the details about the case: https://lnkd.in/eMZ2Smwd 💡 What can your organisation learn from this action? Data breaches of this kind are never just technical failures. What might seem like a simple error, such as including an address in a document that didn't need it, can expose someone to real and immediate danger. Organisations should: • make sure staff know how to handle personal information with care and are able to accommodate any requests for privacy or security; • ensure training is thorough and relevant by making it role-specific and tailored to the tasks staff carry out; • review default templates and processes to ensure personal information, such as addresses, is only included where it is legally necessary; and • always double check before any personal information is transferred, altered or disclosed, for example confirming an address has been redacted. Our Ripple Effect campaign calls on organisations to recognise the real-world impact of data breaches and the devastating effects they can have on people’s lives – especially those in vulnerable situations. Find resources your organisations can use as part of our campaign: https://lnkd.in/erpQB8Uf

Menopause awareness is important. But creating a menopause-friendly workplace takes more than awareness alone. October is Menopause awareness month, and we’re sharing five things we’ve learned help to create a more supportive environment for colleagues experiencing perimenopause and menopause 1. Give managers the skills and confidence to have supportive conversations: We’ve put menopause training in place for all for managers and employees with more than 380 colleagues now having completed their training. How’s it helping: ICO Manager: “I try to be a supportive team manager, but I wouldn’t have thought to associate low confidence, poor concentration or brain fog with the menopause. 2. Have clear policies and support in place: We’ve built a menopause policy so that staff understand exactly what support is available. How is it helping: ICO Menopause network member: "When brain fog became overwhelming, I used the Employee Assistance Scheme. Having that support available made a real difference." 3. Create peer support networks: Through our Menopause Network and monthly Menopause Support Group, colleagues can connect with others, share experiences and learn from one another. How’s it helping; ICO Menopause network chair, "We're proud to be able to provide that safe space and offer support for our members and each other at work so no one feels alone and they have somewhere to turn to when things get tough." 4. Encourage open conversations and reduce stigma: We regularly share stories, resources and experiences to help normalise conversations about menopause and create a culture where people feel comfortable talking openly. How it’s helping: ICO colleague, "I'm not at this stage of life yet, but seeing colleagues openly share their experiences through initiatives like the Black Cardigan campaign, support groups and awareness events has made menopause feel much less like an unknown. It's given me the confidence to ask questions, learn more, and feel prepared for the future." 5. Recognise the range of symptoms: We've worked to raise awareness that there is no single menopause experience. By sharing lived experiences and encouraging conversations, we're helping colleagues understand the wide range of symptoms people may experience, including chronic pain. How it's helping: ICO Menopause network member: "During perimenopause, I developed severe pain in my back, shoulder and neck. I went to A&E several times because I thought I was having a heart attack. Finding the right treatment and workplace adjustments made a huge difference. My advice would be: don't suffer in silence." Menopause affects everyone differently, but one thing that our network have worked to demonstrate is clear: creating a supportive workplace isn't about having all the answers. It's about being willing to listen, learn and create an environment where people feel able to access the support they need.

At the age of 12, Nkechi entered foster care after her mother entrusted her care to Camden Council. Years later, she is trying to piece together what happened and understand the decisions that shaped her childhood. To do that, she needs access to her care records. The Observer podcast series follows Nkechi Simms, a successful actor as she tries to find out what happened to her and why. You can listen to the series: https://lnkd.in/enXKDpKH We responded to Nkechi's powerful account of accessing her care records [first published in the Observer Letters: https://lnkd.in/e6QXaBq6] as it shines a light on an important issue that affects thousands of people with care experience. Care records represent so much more than personal data and trying to make sense of your own childhood should never become such a battle. We are pleased that Nkechi was inspired by our Better Records Together campaign to once again pursue access to her records, but we are frustrated and disheartened, on her behalf, that doing so led to such a traumatic experience. Sadly, it reflects what we’ve heard from hundreds of people with care experience. Most faced long delays and poor communication along the way and after finally receiving their records, nearly nine in ten people we spoke to were left with unanswered questions. This is a systemic problem, and organisations must do better. Providing people with their care records is the law. Records should never arrive late, without warning, or without appropriate support on hand to help navigate difficult or unexpected details. As the data protection regulator, we’ve produced new standards to help organisations get this right. We are speaking to Camden Council about our concerns and expectations following Nkechi’s experience. But this is about more than one council. We are calling on every UK local authority and Northern Irish Health and Care Trust to commit to improving care records access, resourcing their teams appropriately and implementing our standards so requests are met with care. Regrettably, Nkechi's story is not an isolated failure. It should be a wake-up call to every organisation holding a child's care records today. By putting that child first now, we can spare years of pain in the future for the adult that they will become. We have resources for anyone looking to access their records and for frontline services to help respond better to those requests: https://lnkd.in/ekae4hY6

If foundation models are to drive the next phase of artificial intelligence (AI) adoption, developers must give businesses and the public confidence that personal data is being used lawfully, transparently, and with effective safeguards in place. Trust must be built into model development and AI governance practices from the outset. Our recent report sets out to answer the key questions for developers: 👉 Can a foundation model itself contain personal information? The report says foundation models may contain personal information and developers should assess this on a case-by-case basis. 👉 What happens when personal information is used to train AI systems? The report sets out expectations on transparency, lawful basis and information rights where personal information is used for training. 👉 How do organisations prove their safeguards actually work? The report repeatedly calls for evidence-based assessments rather than unsubstantiated claims about risk reduction. 👉 What should organisations do about special category data? The report examines the circumstances in which special category data may be involved in foundation model training, the additional protections required, and the challenges developers face in identifying appropriate Article 9 conditions. You can read our report in full: https://lnkd.in/e8D72V_D

Effective regulation depends on strong leadership, diverse perspectives and constructive challenge. As part of our transition to the Information Commission, we've welcomed a new Board that brings together expertise from across regulation, governance, business, technology, law and public policy. Strengthening how we are governed is an important part of our ambition to become a more connected, capable and confident regulator; one that is closer to the communities and organisations we serve, better equipped to respond to change and clear about where we can make the greatest difference. Swipe through to meet the members of the Information Commission Board and learn more about the expertise and perspectives they bring to the organisation. Read more about the Board: https://lnkd.in/eRYikHi4