Business Law Library & Tracker
Privacy & Data
Privacy notices, data handling, marketing, cookies and breach response.
Sources last reviewed 10 Aug 2026
Main law guides
122
Acts, regulations and codes worth reading first
Topics
60
Plain-English clusters
Published case explainers
143
Selected cases with a business lesson
Tracked updates
13
New, amended & reviewed
Plain-English explainers, not legal advice. Use the linked official source for section-level detail, and get advice for your situation.
Get legal helpMain laws
Data (Use and Access) Act 2025
UKPGA 2025 c 18
Data Protection Act 2018
UKPGA 2018 c 12
Network and Information Systems Regulations 2018
SI 2018/506
Privacy and Electronic Communications Regulations 2003
SI 2003/2426
Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023
SI 2023/1007
Product Security and Telecommunications Infrastructure Act 2022
UKPGA 2022 c 46
UK GDPR
Regulation (EU) 2016/679 as retained in UK law
Tracker
- New13 June 2026
Data use and access reform added for UK digital businesses
Digital businesses should map customer data flows, vendor contracts and verification journeys now so commencement and regulator guidance can be actioned without rebuilding the product in a rush.
Privacy & DataDigital & Ecommerce - Reviewed13 June 2026
Online platform and connected-product rules expanded
Founders should check scope before adding user-generated content, messaging, marketplace listings or smart-device features, because moderation and product-security controls need to be designed into the workflow.
Digital & EcommercePrivacy & Data
Cases
Andrew Dixon v GlobalData plc
If your business gives comfort to a departing employee about share options, treat that as a serious legal commitment, not just a commercial reassurance. In this...
DSG Retail Limited v The Information Commissioner
If your business can identify a person from information in its systems, you should usually treat that information as needing appropriate protection, even where an...
Angela Emmerson v Human Givens Institute Limited
For ordinary businesses, the durable lesson is simple: do not assume you can share information just because one person involved says yes. If your business holds...
Mex Group Worldwide Limited v Adam Duthie & Anor
For business owners, the durable lesson is not about the underlying cross-border fight. It is about control of confidential information once a relationship with a...
Andrew Prismall v Google UK Limited & Anor
Do not treat this case as permission to take broad rights over sensitive data. The court upheld the strike out because of the way the claim was framed as a...
Lloyd v Google LLC
The decision reduced one route for large-scale data claims, but it does not make privacy risk small. Businesses still need clear tracking, consent, data-use and...
Trailfinders Ltd v Travel Counsellors Ltd & Ors
For ordinary businesses, the lesson is simple: do not treat customer lists as fair game just because a recruit knows the customers, can remember some details, or...
WM Morrison Supermarkets plc v Various Claimants
The decision helped employers on vicarious liability, but it is not a reason to relax data security. Businesses still need access controls, audit trails, incident...