As we move through 2026, data protection remains a fast-moving area for organisations operating in England and Wales. While the core principles of UK GDPR continue to apply, the regulatory, technological and enforcement landscape is evolving. Businesses that treat data protection as a static compliance exercise risk falling behind. Below, we highlight the key developments and priorities that should be firmly on your radar this year.

Regulation Is Becoming More “Practical”

Recent reforms to the UK data protection regime have been positioned as a move towards flexibility and innovation. In practice, however, organisations should not assume a reduction in compliance expectations. Regulators are increasingly focused on outcomes: transparency, accountability and demonstrable risk management.

This means policies alone are no longer sufficient. Organisations should expect scrutiny of how data protection frameworks operate in practice, including training, decision-making records and evidence of senior oversight.

Enforcement Risk Is Shifting, Not Disappearing

While headline fines still attract attention, enforcement in 2026 is characterised by a broader toolkit. Regulators are making increased use of warnings, reprimands, enforcement notices and targeted audits, often accompanied by reputational risk and operational disruption.

Notably, enforcement is increasingly focused on:

· Failure to embed data protection by design and by default

· Poor governance over third-party processors and suppliers

· Inadequate responses to data subject rights requests

Organisations should ensure that internal processes are robust, tested and capable of standing up to regulatory challenge.

AI and Automated Decision-Making Remain High-Risk Areas

Artificial intelligence and advanced analytics continue to dominate regulatory attention. Even where AI systems are procured “off the shelf”, organisations remain responsible for compliance with data protection law.

Key risk areas include:

· Lawful basis for processing large datasets

· Transparency around automated decision-making

· Data minimisation and purpose limitation

· Managing bias and accuracy

Data Protection Impact Assessments (DPIAs) are increasingly expected for AI-driven systems, and organisations should be prepared to justify not only whether a system is lawful, but why it is appropriate.

International Data Transfers Require Ongoing Attention

International data transfers remain a complex issue, particularly where data flows involve jurisdictions without adequacy decisions. Standard Contractual Clauses and Transfer Risk Assessments are no longer a “set and forget” exercise.

In 2026, regulators expect organisations to:

· Keep transfer assessments under review

· Monitor changes in recipient country laws

· Actively manage supplier compliance

This is especially relevant for organisations using global cloud providers, outsourced IT support or overseas group companies.

Accountability and Governance Are Front and Centre

The accountability principle under UK GDPR is receiving renewed emphasis. Organisations must be able to demonstrate compliance, not merely assert it.

Practical steps include:

· Clear records of processing activities

· Regular reviews of privacy notices and policies

· Meaningful staff training (not just tick-box exercises)

· Active involvement of data protection officers or advisers

For many organisations, periodic “health checks” or audits are proving invaluable in identifying gaps before regulators or claimants do.

Looking Ahead

Data protection in 2026 is less about reacting to new laws and more about embedding good governance into everyday operations. Organisations that invest in practical, proportionate and well-documented compliance frameworks will be best placed to manage regulatory risk while continuing to innovate.

If you have any queries or need any assistance relating to data protection, please do not hesitate to contact us at commercial@berrysmith.com or on 029 2034 5511.