TO BE PUBLISHED January 2027
Starting from:
£99 + VAT
Format: DOWNLOADABLE PDF
This conference will consider next steps for data protection in the UK, with recent reform moving into practice and further policy development under consideration. Areas for discussion include the future role and regulation of data intermediaries, implications of AI and data-intensive technologies, the future of international data flows and adequacy, remaining questions around individual rights and redress, and priorities for regulatory guidance, enforcement and further reform.
It will bring together stakeholders with policymakers to discuss the main data protection reforms in the Data (Use and Access) Act 2025 now in operation, as well as issues raised by the Government’s 2026 consultation on data intermediaries, alongside calls for evidence on AI and data-intensive technologies and international data flows. Delegates will consider the legal roles and responsibilities of intermediaries, areas where organisations continue to face uncertainty in applying data protection requirements to emerging technologies, the usability of international transfer arrangements, and opportunities for further guidance, clarification or regulatory change.
Practical questions now arising for controllers, technology developers, intermediaries and public bodies will be considered, including verifying delegated requests, applying revised automated-decision rules and managing international transfers.
Attendees will also consider routes to challenge and redress, differing views on consent and control, compliance burden and regulatory certainty, and the appropriate approach to guidance and enforcement. Discussion will examine the extent to which the next phase of policy should focus on clarification of the existing framework or more substantive change.
Data intermediaries, Smart Data & trusted data sharing
The agenda will consider next steps following the Government’s consultation on data intermediaries, including the legal basis on which intermediaries act, practical implications for controllers receiving delegated requests, and safeguards for individuals. Discussion will also look at the development of Smart Data and wider trusted data-sharing models, including their potential contribution to portability, competition, research and improved services.
Areas for discussion include:
- delegation & liability: legal status and responsibilities of data intermediaries - delegation of data-subject rights - liability where requests are mishandled
- controller verification:
- proportionate checks on delegated requests - protection for controllers verifying requests appropriately
- safeguards against speculative or bulk requests - scope for standardised processes
- trust & safeguards:
- the interests intermediaries are expected to represent and how this can be reflected in their duties and governance
- possible approaches to neutrality, fiduciary duties, registration or an industry-led code - risks from coerced delegation and concentrated data holdings
- power & representation:
- meaningful consent and power imbalances in the use of intermediary services - risks around commercialisation and employer control of workplace data
- how collective interests can be represented alongside individual rights - public awareness, trust and control
- Smart Data: lessons from Open Banking - development of Open Finance and wider Smart Data schemes - interoperability, digital identity and consumer consent
- wider data sharing:
- access across health, research, financial services and public services - governance arrangements and how public benefit is identified and assessed
- supporting research, competition and improved services while maintaining individual rights and public confidence
Data protection reform in practice - rights, enforcement & guidance
Sessions will assess practical experience as principal data protection reform in the Data (Use and Access) Act 2025 approaches its first anniversary, including revised lawful bases and access requirements, complaints and redress, and organisational compliance. Discussion will also consider the Information Commission’s approach to guidance and enforcement under its new governance arrangements, and where further regulatory certainty or policy development may be needed.
Areas for discussion include:
- lawful bases & access rights: experience of recognised legitimate interests as a distinct lawful basis - subject access requests - consistency of interpretation across sectors
- complaints & redress: operation of statutory complaints-handling duties - acknowledgement, investigation and response - proportionality, record-keeping and regulatory escalation
- regulatory approach:
- use of the Information Commission’s investigatory and enforcement powers - roles of guidance and enforcement in supporting compliance
- effectiveness of deterrence, including the regulator’s approach to public-sector enforcement - proportionality and regulatory certainty
- compliance capability:
- priorities for guidance, training and organisational accountability across SMEs, charities and public bodies
- cyber resilience and incident response - relationship between data protection and information security
- children’s data: requirements for services likely to be used by children to take account of children’s needs - interaction with online safety and age assurance requirements
- policy direction:
- priorities following the 2026 consultation and calls for evidence - further guidance, codes of practice and secondary legislation
- targeted reform and questions around more fundamental changes to the UK data framework
Data regulation for AI & automated decision-making
Policy and regulatory priorities in applying data protection law to AI and other data-intensive technologies will be examined. This includes where organisations experience uncertainty or practical difficulty, and how the revised rules on automated decision-making are working in practice. Questions raised by the Government’s 2026 call for evidence on data quality, access and provenance will be discussed, looking at governance across organisations, transparency and rights, and whether existing frameworks remain effective as technologies develop.
Areas for discussion include:
- automated decisions:
- operation of revised rules on significant solely automated decisions - meaningful human involvement
- ways for individuals to challenge decisions - retained protections for special category data - development of the statutory code on AI and automated decision-making
- data quality: accuracy and completeness of data used by complex systems - downstream consequences for individuals and organisations - correction and redress
- training data: access and provenance - reuse for R&D under the revised rules - transparency and rights in complex data environments
- complex supply chains: accountability across AI supply chains - assurance, auditing and governance - oversight of increasingly autonomous systems, including agentic AI
- privacy-enhancing technologies: synthetic data, federated learning and confidential computing - practical contribution to reducing privacy and security risks
International data flows, adequacy & resilience
With EU adequacy renewed until December 2031, sessions will consider the practical operation of the UK’s international transfer regime and implications of future divergence for organisations that value regulatory interoperability. We expect discussion to draw on questions raised in Data flows you can trust, including usability of transfer mechanisms, organisational decision-making, security, resilience and technological sovereignty.
Areas for discussion include:
- transfer mechanisms: usability of adequacy regulations, the International Data Transfer Agreement and other transfer tools - application of the Act’s revised data protection test
- organisational practice:
- transfer risk assessments - contractual and technical controls - transfers involving remote access
- compliance costs, particularly for smaller organisations trading internationally
- UK-EU relationship:
- operation of renewed adequacy arrangements - implications of future UK reform and changes to the EU framework
- scope for a distinct UK approach while maintaining interoperability
- wider partnerships: UK-US Data Bridge and other international transfer mechanisms - interoperability between regulatory regimes - implications for digital trade and investment
- security & sovereignty: cloud and supply chain dependencies - resilience - technological sovereignty - maintaining effective safeguards
All delegates will be able to contribute to the output of the conference, which will be shared with parliamentary, ministerial, departmental and regulatory offices, and more widely. This includes the full proceedings and additional articles submitted by delegates. As well as key stakeholders, those already due to attend include officials from the Department for Digital, Culture, Media and Sport; Department for Education; Department for Energy Security and Net Zero; Department for Environment, Food and Rural Affairs; Department of Health and Social Care; Health and Safety Executive; HM Revenue and Customs; Home Office; Information Commissioner’s Office; Intellectual Property Office; Medicines and Healthcare products Regulatory Agency; Ministry of Housing, Communities and Local Government; National Crime Agency; Ofcom; Planning Inspectorate; UK Health Security Agency.
