Data Protection Day Conference 2026

A fast changing UK and global regulatory environment

Attendees heard that 2026 will see significant shifts driven by the DUAA 2025, updated ICO powers and new sector specific rules. There was strong discussion about how UK and EU approaches continue to diverge in some areas yet converge in others, creating a complex environment to navigate. As further progressed by presentations on developments in the US, Middle East and Asia, there was also discussion on the growing geopolitical lens applied to data laws worldwide, including stricter breach reporting timelines and increased scrutiny of international transfers.

 

Cyber resilience as a core organisational priority

The growing frequency and impact of cyberattacks featured heavily in conversations throughout the day. The Cyber Security and Resilience Bill was highlighted as a development that could reshape expectations for businesses operating in the UK. Practical discussions focused on the need for robust and regularly tested incident response plans, clear supply chain oversight, and strong governance structures. The message was clear: cyber resilience is an organisation wide priority.

 

The rising influence of AI across compliance and risk

AI is driving new trends in data subject rights requests, increasing the volume, speed and complexity of DSARs that organisations receive. AI is also reshaping regulatory expectations, with global markets taking different approaches to innovation, national security and data governance. Speakers stressed the importance of risk aware approaches that allow organisations to innovate confidently while meeting rapidly changing legal requirements. 

 

Data governance and accountability under sharper scrutiny

Across multiple panels, the need for strong governance fundamentals was repeatedly reinforced. This included clear ownership of compliance functions, well maintained records, tested policies, and consistent cross functional communication. Recent enforcement trends show regulators paying close attention to timeliness, accuracy and documentation. There was also discussion about the recognition of non-material harm and the increasing likelihood of enforcement actions against processors as well as controllers.

 

Practical approaches to doing more with less

A recurring theme was the reality of limited resources for many organisations. Contributors shared practical methods for building engagement across teams, tailoring training for different roles and environments, and communicating compliance responsibilities in a more relatable way. Emphasis was placed on finding realistic and proportionate solutions rather than aiming for theoretical perfection. 

 

The day highlighted just how rapidly this space is moving and underscored the importance of adaptable, resilient and well embedded compliance programmes. We are grateful to all who joined us and contributed to a lively and insightful set of discussions.

If you would like to discuss any of the topics covered in more detail, please feel free to get in touch with our team, we would be very happy to continue the conversation.