Key legal developments for in-house lawyers: May 2026 edition

Insight

15.05.2026

Data protection

Court of Appeal ruling on what amounts to 'personal data'

The Court of Appeal has found in favour of the Information Commissioner's Office (ICO) on the scope of the duty to keep personal data secure. DSG Retail Limited, fined by the ICO in 2020 after a cyber-attack affected the personal data of at least 14m people, argued that: 

(i) data stolen by a hacker could not be personal data if individuals could not be identified from it; and therefore

(ii) the security obligations could not apply (or be breached) in relation to that data.

The court disagreed. It held that it is enough that the data controller (here, DSG) could indirectly identify the individuals from that data. It did not matter that the hacker could not. 

Note also the obiter comments on anonymisation. The obligations on data controllers fall away if data is truly anonymised in the hands of the data controller. But that was not the case here.

Consent should be assessed objectively

The Court of Appeal has ruled in favour of Sky Betting and Gaming over a 2025 High Court ruling concerning marketing material sent to a customer who self-identified as a problem gambler. The question was whether Sky had obtained the necessary consent to send direct marketing. The High Court indicated there should be an element of subjectivity in assessing whether consent had, in fact, been given. 

The Court of Appeal has overturned that approach.

When assessing whether consent has been given, a data controller must show that a data subject made an ‘indication’ of their wishes regarding data processing for the purposes of direct marketing. This indication should be based on the objective criteria of the consent being freely given, specific, informed and unambiguous by the user.

The data controller does not have to prove what was actually in the mind of the individual data subject at the time of the indication. It is neither necessary nor relevant to explore whether the individual data subject was vulnerable, or had an impaired ability to make fully autonomous decisions.

This is likely to be a welcome decision for businesses engaging in direct marketing.

Changes to data protection legislation

The Data (Use and Access) Act 2025 (DUAA) is being implemented in phases and makes some meaningful, if targeted, changes to the UK GDPR regime.

Key impacts include:

a new 'recognised legitimate interests' lawful basis (limited in scope but helpful for disclosures linked to crime prevention and safeguarding);
a relaxation of the rules on automated decision‑making (opening the door to greater use of AI and algorithms where appropriate safeguards are in place);
a revised test for international data transfers based on whether overseas protections are 'not materially lower' than UK standards; and
a mandatory internal complaints handling process from June 2026, which is likely to increase formal data protection complaints requiring careful governance.

For a more detailed analysis of the reforms, please see our article: Data (Use and Access) Act 2025: five key changes for businesses.

DMCCA subscription reforms – now due spring 2027

The government has published its response to its consultation on the new subscription reforms under the Digital Markets, Competition and Consumers Act 2024 (DMCAA), and proposed next steps. In headline terms, these reforms are now set to come into force in spring 2027 and remain broadly as expected.

The most important change is that consumers will have an additional 14-day cooling-off period after any trial period or following any auto-renewal period to cancel a subscription contract. 

There is an important carve-out for charities and cultural organisations. Charitable memberships allowing consumers to attend performances, see collections, or visit places like museums or galleries, provided these activities are related to their charitable purpose, will be expressly excluded from the DMCCA.

Any organisation that sells via subscription models to consumers should assess the possible impact of these changes now so that their terms of business are fully compliant with the new law when it comes into force.

Important changes to late payment terms legislation on the horizon

The government has just unveiled changes to late payment legislation in a move described as the 'toughest crackdown on late payments in 25 years'.

The most significant change is the prohibition on being able to contract out of the standard rate of interest for late payments. Suppliers will have an automatic right to the statutory rate of interest (8% above the Bank of England base rate) for late payments. Any clauses seeking to lower this rate of interest will be rendered redundant.

For a more detailed analysis of the proposals, and what they might mean for your payment processes, see this article on the government's late payment reforms by Antonia Lyne and Matthew Konadu-Yiadom.

Artificial intelligence

No substantive changes to copyright law

The UK government has issued its report on copyright and AI following last year's consultation. The main takeaway is that no major changes to copyright law will be made at this stage, although the government does intend to remove copyright protection for computer‑generated works without a human author.

Laura Monaghan and Ethan Ezra take a detailed look at the report here in their article on UK copyright and AI.

Regulators' guidance on using and responding to the use of AI tools

Most in-house lawyers are already seeing the impact AI is having on their workload. Both advising internal clients on their compliance duties when using AI tools – including agentic models – within the business, and when dealing with customers and members of the public who are using AI tools to raise grievances and complaints.

A number of regulators have recently published guidance on these issues. In particular:

CMA guidance on how to comply with consumer law when using AI agents. In summary:
- tell consumers if you are using an AI agent; and
- train your AI agent to comply with consumer law.
ICO guidance on how to deal with AI-generated FOI requests. Of particular interest is its commentary on when repeated or low‑quality requests may become vexatious, together with suggested wording that public authorities might include on their websites to explain their approach to requesters using AI tools.
CMA guidance on the competition and consumer risks associated with algorithmic pricing, including the risk of hub‑and‑spoke collusion.

Contract law

This can't go on – contract termination

Two recent cases on contract termination are helpful reminders to always think about the exit when entering into an agreement.

Anheuser-Busch International v Commonwealth Brewery provided helpful guidance on when an implied term that a contract can be terminated on 'reasonable notice' may be construed, and how to determine what reasonable may be in any given situation.

This case involved an informal but long-running distribution agreement. The court stressed that the chief purpose of a notice period was to enable the parties to bring the relationship to an end in an orderly way.

Factors relevant to assessing reasonableness included the formality of the contract and the importance of the terminated business to the party receiving the notice of termination. On the facts, the court held that three and a half months' notice was reasonable.

This is a useful read if you are ever asked to advise on a contract with no obvious get-out mechanism.

In Zaha Hadid Limited v The Zaha Hadid Foundation, the Court of Appeal considered whether a trade mark licence, expressed to 'continue indefinitely' could be terminated by either party on reasonable notice.

Through construing the terms of the licence, the court held that it was terminable on reasonable notice by either party, even though the agreement included express termination rights only for the licensor. The court drew a clear distinction between an indefinite contract (which can be brought to an end on notice) and a perpetual contract (which cannot).

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.