Claude Mythos and the Accountability Gap: What Happens When AI Finds the Weakness First?

12 minutes read

What happens when AI finds the weakness before you do?

Most businesses know the basics: patch systems, manage access, check suppliers and prepare for breaches.

The problem is not awareness.

The problem is delay.

Those tasks get pushed into “next quarter”, passed between teams, half-documented or quietly left to gather dust in a folder labelled “cyber review”. Claude Mythos makes that habit harder to ignore.

Anthropic’s Claude Mythos Preview has attracted attention because of its advanced cyber capabilities. The UK AI Security Institute evaluated the model and found that it showed significant improvement on capture-the-flag challenges and multi-step cyber-attack simulations. In controlled testing, where AISI explicitly directed the model and gave it network access, the model could carry out multi-stage attacks on vulnerable networks and discover and exploit vulnerabilities autonomously. (AI Security Institute)

That sounds dramatic. It is.

But for most organisations, the key issue is not whether Claude Mythos itself will attack them.

The better question is this:

If AI can find vulnerabilities faster, can your organisation show that it manages cyber and data protection risk quickly enough?

That is the accountability gap.

Claude Mythos is not just a hacking story

The public debate around Claude Mythos has focused on cyber capability. That makes sense. “AI can help find software vulnerabilities” is a more exciting headline than “please review your supplier register”, even though the second one is probably where the real trouble starts.

AISI reported that Claude Mythos Preview achieved a 73% success rate on expert-level capture-the-flag tasks. It also became the first model to complete “The Last Ones”, a 32-step simulated corporate network attack, succeeding from start to finish in 3 out of 10 attempts and completing an average of 22 out of 32 steps across all attempts. (AI Security Institute)

Why multi-step attacks matter

Real cyber incidents rarely happen in one clean step.

Attackers often move through a chain of activity: reconnaissance, access, privilege escalation, movement across systems and exploitation.

In plain English: they do not usually knock politely on the front door. They look for a loose window, climb in, find the keys, wander around and then everyone acts surprised that the security policy did not save them.

AI systems that can help connect those steps change the risk environment.

But Claude Mythos is not only a story about what attackers might do. It is also a story about what businesses may now need to prevent, detect, document and explain.

The old basics matter more, not less

It would be easy to treat advanced AI cyber capability as something so futuristic that normal organisations cannot do anything about it.

That would be convenient.

It would also be wrong.

AISI did not test Mythos against fully defended real-world systems. Its test environments lacked protections such as active defenders and defensive tooling. AISI therefore said it could not conclude that Mythos Preview could attack well-defended systems. (AI Security Institute)

Weak security is becoming easier to expose

AISI’s practical message was still clear: Mythos Preview can exploit systems with weak security posture, and more models with similar capabilities are likely to follow. AISI highlighted basic controls including regular security updates, robust access controls, secure configuration and comprehensive logging. (AI Security Institute)

So the lesson is not “buy a panic room for your servers”.

The lesson is this:

Weak security basics are becoming easier to find, easier to test and harder to excuse.

For many organisations, the biggest risk is not a science-fiction AI attack. It is much more ordinary:

software that nobody patched;
excessive admin access;
old accounts that still work;
suppliers with unclear security obligations;
systems nobody owns;
logs nobody checks;
incident plans nobody has tested;
policies that say the right thing while reality quietly does something else.

Claude Mythos does not create all of those weaknesses.

It makes them more exposed.

The real issue: can you evidence “appropriate security”?

This is where the data protection angle matters.

The UK GDPR requires organisations to process personal data securely using appropriate technical and organisational measures. The ICO explains that this security principle requires organisations to consider risk analysis, organisational policies, and physical and technical measures. (ICO)

That does not mean perfect security. No regulator expects a small business to defend itself like a national intelligence agency, which is merciful, because most organisations are still debating who owns the shared inbox.

But it does mean organisations must match their security measures to the risk.

“Appropriate” changes as the threat changes

The word appropriate matters.

As cyber capability changes, what counts as appropriate may also change.

If AI-assisted tools make it easier to discover and exploit weaknesses, organisations may need to ask whether their current arrangements still work.

Not in theory.

In evidence.

Can you show:

what systems hold personal data;
who has access;
when teams last reviewed access;
how quickly teams apply critical patches;
which suppliers access or host personal data;
what contracts say about cyber incidents;
when your breach response plan was last tested;
how teams escalate risks;
who makes notification decisions;
what records you keep?

The question after a breach is not only “what happened?”

After a personal data breach, regulators, customers, insurers and business partners may ask a second question:

What did you do before it happened?

That is where many organisations get uncomfortable.

Not because they did nothing, necessarily. Often, they did some of the right things. The problem is that nobody recorded them clearly, nobody owned them properly, or nobody checked whether they still worked.

That is the accountability gap in practice.

The overlooked issue: supplier risk

One of the most under-discussed issues with Claude Mythos is not just who can use AI to find vulnerabilities.

It is who benefits first when vulnerabilities are found.

Anthropic’s Project Glasswing gives selected organisations and critical software maintainers access to Claude Mythos Preview for defensive work. Anthropic describes the initiative as a way to secure critical software and give defenders a head start, with launch partners including AWS, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. (Anthropic)

Most businesses will not get direct access to frontier AI tools

Project Glasswing may help improve widely used software. If major providers find and fix vulnerabilities earlier, many downstream users may benefit.

But most ordinary businesses will not use frontier AI security tools directly.

SMEs, charities, professional services firms and smaller regulated businesses usually depend on:

software vendors;
cloud providers;
managed IT providers;
payment platforms;
HR systems;
marketing platforms;
outsourced processors;
cyber security suppliers.

That creates a practical accountability problem.

If AI accelerates vulnerability discovery, businesses need to know whether their suppliers can respond quickly enough.

Supplier security is part of your accountability

It is no longer enough to assume “our provider deals with security”.

Organisations need to understand:

which suppliers process or access personal data;
whether contracts include appropriate security obligations;
how quickly suppliers must report incidents;
who applies updates;
whether suppliers use sub-processors;
what happens if a critical provider suffers a compromise;
whether business continuity plans are realistic.

A supplier’s cyber weakness can trigger your personal data breach obligations.

That is the bit businesses need to sit with, preferably before signing another contract where the security schedule has been treated as decorative paperwork.

The defensive inequality problem

Claude Mythos also points to a wider issue: defensive inequality.

Large technology companies may use advanced AI to find and fix vulnerabilities. They have specialist teams, mature processes, direct access to frontier tools and budgets that do not immediately burst into flames when someone says “security testing”.

Smaller organisations usually do not.

They rely on vendors to fix problems, suppliers to notify them, IT providers to apply patches and internal teams to understand what all of that means for personal data.

SMEs do not need an AI cyber lab

Smaller organisations are not helpless.

But they do need good governance.

For SMEs, the priority is not building their own AI cyber lab. That would be absurdly expensive and, in most cases, about as proportionate as buying a submarine to cross a puddle.

The priority is making sure the basics are understood, documented and owned.

That means:

keeping an up-to-date record of systems and suppliers;
reviewing contracts with key processors;
confirming who handles updates and patches;
checking access controls regularly;
maintaining breach response procedures;
documenting key decisions;
training staff;
testing incident escalation.

This is where data protection governance becomes practical risk management, not just paperwork.

The dual-use dilemma

Claude Mythos also reminds us that AI cyber capability is dual-use.

The same technology that could help attackers find vulnerabilities can help defenders fix them.

Bruce Schneier, writing in The Guardian, argues that modern generative AI systems are becoming good at finding and exploiting software vulnerabilities, but defenders can also use those capabilities to identify and patch weaknesses. He points to Mozilla’s use of Mythos to find vulnerabilities in Firefox, which Mozilla then fixed. (The Guardian)

Attackers and defenders may not move at the same speed

AI may make software more secure in the long run. It could help developers spot weaknesses earlier, test systems more thoroughly and reduce the number of vulnerabilities that reach production.

But the short-term picture may be messier.

Attackers and defenders may both gain new capabilities, but not at the same speed. Some organisations will patch quickly. Others will not. Some suppliers will communicate clearly. Others will send vague emails titled “Important service update” and bury the terrifying bit in paragraph seven.

That is why governance matters.

The question is not only:

What can the AI do?

The better question is:

Who is responsible for managing the risk when AI changes the speed of the threat?

What businesses should do now

Claude Mythos should not push organisations into panic.

It should push them into action.

1. Map your systems and data

You cannot protect what you do not understand.

Organisations should know:

what systems they use;
what personal data they hold;
where that data sits;
who can access it;
which suppliers are involved;
which systems support critical services.

This should connect with your records of processing, supplier register, asset list and breach response process. If those things do not speak to each other, now is the time to fix that.

2. Review supplier contracts and security commitments

Supplier risk creates one of the biggest practical issues.

Businesses should check whether key contracts clearly cover:

security standards;
incident notification timescales;
audit or assurance rights;
use of sub-processors;
patching responsibilities;
business continuity;
return or deletion of data;
support with regulatory obligations.

The aim is not to turn every supplier relationship into a legal wrestling match. Tempting, but no.

The aim is to know where responsibility sits before something goes wrong.

3. Check patching and vulnerability management

If AI tools can find vulnerabilities faster, delays matter more.

Businesses should know:

who applies updates;
how teams prioritise critical patches;
whether unsupported systems remain in use;
how suppliers update managed systems;
whether teams record patching decisions;
who approves and reviews exceptions.

“Someone in IT probably sorts that” is not a control. It is a hope wearing a lanyard.

4. Tighten access controls

Access is one of the most common weak points.

Organisations should review:

multi-factor authentication;
admin privileges;
shared accounts;
leaver access;
dormant users;
supplier accounts;
role-based permissions.

People should have the access they need, not the access they accidentally inherited during a project three reorganisations ago.

5. Test your breach response plan

A breach response plan only helps if people know how to use it.

Testing should cover:

who identifies and escalates incidents;
who assesses whether personal data is involved;
who contacts suppliers;
who decides whether the organisation must notify the ICO;
who manages affected individual communications;
who speaks to insurers;
who keeps the decision log;
who updates senior management.

A plan that nobody has tested is not a plan. It is decorative compliance.

6. Bring AI governance into the same conversation

Organisations cannot treat AI governance, cyber security and data protection as separate boxes.

If staff use AI tools to write code, review documents, analyse logs, summarise customer information, generate marketing content or automate workflows, organisations need clear rules.

That means:

acceptable use policies;
AI supplier due diligence;
confidentiality controls;
human review;
records of AI use;
risk assessments for higher-risk tools;
clear accountability.

The issue is not just whether staff use AI.

It is whether anyone knows how, where, why and with what safeguards.

The Athlex view

Claude Mythos is not a reason for businesses to despair.

It is a reason to stop pretending that cyber security, data protection and AI governance are separate conversations.

They are not.

AI may change the speed at which vulnerabilities are found. It may change what attackers can do. It may also change what defenders can achieve.

But for most organisations, the immediate challenge is simpler:

Can you show that you understand your risks and have taken reasonable steps to manage them?

That is the accountability gap.

The practical lesson for ordinary businesses

Claude Mythos may be a frontier AI story, but the lesson for ordinary businesses is practical:

know what data you hold;
know where it sits;
know who has access;
know which suppliers matter;
know how incidents are handled;
know whether your controls actually work;
document the decisions you make.

AI may be getting better at finding weaknesses.

Businesses need to get better at fixing them, and proving they did not ignore them.

At Athlex, we help organisations make data protection, AI governance and practical compliance easier to understand, easier to evidence and easier to maintain.

Because waiting until a vulnerability becomes a breach is not a strategy.

It is procrastination with consequences.

Need help reviewing your data protection, supplier or AI governance arrangements?

Athlex helps organisations turn complex compliance requirements into clear, practical steps.

From supplier reviews and breach readiness to AI governance and data protection documentation, we help you understand your risks before they become problems.

The Top ICO Enforcement Trends SMEs Must Act On in 2025

5 minutes read

And How to Get Ahead

The UK’s data-protection landscape is evolving fast, and SMEs are now directly exposed to enforcement action once largely associated with public bodies or large multinationals. As the BDO enforcement trends analysis reviewing ICO enforcement trends 2025, highlights, the ICO is increasingly focused on fundamental compliance failures rather than technical edge cases, meaning SMEs face the same expectations as larger organisations.

To help UK SMEs stay ahead, this guide breaks down the three most prominent ICO enforcement themes in 2025 and explains how each relates directly to the core duties under UK GDPR.

ICO Enforcement Trend 1: DSAR Delays & Right-of-Access Failures

The ICO continues to treat DSAR delays as one of the most serious indicators of poor governance. This theme appears repeatedly in enforcement notices and aligns closely with the BDO analysis.

A recent example is the enforcement notice issued to South Wales Police, requiring the organisation to clear a backlog of more than 350 overdue SARs by mid-2026.

Although policing bodies sit in a unique context, the principle is identical for SMEs:
a delayed, incomplete, or mismanaged DSAR is a governance failure, not an administrative error.

Why SMEs are vulnerable

DSAR processes are often informal or undocumented
Staff rely on untracked shared inboxes that hamper compliance
Manual redaction takes longer than expected and slows response times
Identity verification checks are inconsistent or incomplete
No clear owner is assigned to coordinate DSAR responses

Consequently, SMEs often fail “by accident”, simply because processes were never clearly built.

What SMEs should do

Implement a formal DSAR register
Use standardised verification templates
Assign responsibility for triage and drafting
Create a redaction decision record
Test your DSAR workflow every six months

See how Athlex Data Protection can help you with your UK GDPR compliance.

To strengthen your position, Athlex Data Protection includes DSAR review as part of its Free UK GDPR Compliance Audit.

ICO Enforcement Trend 2: System Errors & Data-Accuracy Failures

While many SMEs assume breaches are caused by sophisticated threat actors, the ICO’s recent fines show that basic security failings, particularly around access control and system configuration, remain the driving force behind most incidents. This is why BDO identifies weak security controls as a recurring enforcement theme.

A clear example of this is the £3.07 million fine issued to Advanced Computer Software Group (“Advanced”), a major processor used across the UK health and education sectors.

What happened

A ransomware attack exploited several preventable vulnerabilities, including:

inadequate access controls,
outdated software components,
unpatched critical systems, and
insufficient segregation of sensitive data.

Because Advanced was acting as a data processor, the incident demonstrated that processors are not insulated from ICO enforcement. Importantly, the ICO highlighted that robust Article 32 security measures apply equally to processors and controllers — a point many SMEs overlook when relying on third-party suppliers.

Why this matters for SMEs

Many SMEs rely on external IT providers, SaaS dashboards, or outsourced infrastructure. Consequently, they often inherit a false sense of security. Yet, as the Advanced case shows:

unpatched systems,
misconfigured access rights, and
weak administrator controls can create breach pathways that affect both the processorand its clients.

Furthermore, the ICO’s commentary stresses that technical misconfiguration is increasingly treated as a governance failure, not an unavoidable risk. In other words, SMEs are expected to demonstrate continuous security management – not reactive fixes after an incident.

What SMEs should do now

To reduce exposure to similar enforcement action:

Conduct regular patch-management reviews and document them.
Enforce multi-factor authentication onevery administrative and remote-access account.
Validate that third-party systems use secure configuration baselines.
Request evidence: recent pen-test summaries, MFA logs, and architecture diagrams showing data segregation.

ICO Enforcement Trend 3: Supply-Chain & Vendor Risk Is Now the Biggest Exposure

BDO notes that third-party suppliers are involved in a significant proportion of enforcement cases. This is evident across recent ICO actions.

A major example is the £14 million fine issued to Capita following a cyber incident that exposed the data of over 6 million people.

The ICO criticised:

slow isolation of the breach,
insufficient monitoring,
weak patching practices, and
inadequate oversight of third-party systems.

Similarly, the Upper Tribunal’s Clearview ruling confirmed that even overseas vendors fall under UK GDPR if they monitor UK residents.

Why SMEs must pay attention

SMEs are more dependent than ever on external providers – IT contractors, payroll services, marketing platforms, CRMs, SaaS tools, cloud storage, etc. Consequently, the regulator expects SMEs to:

verify supplier security
assess processors before onboarding
maintain a vendor register
require evidence of compliance
include audit rights and termination clauses

In other words, your compliance is only as strong as your weakest vendor.

What SMEs should do

Inventory all suppliers with data access
Request evidence: certifications, test summaries, logs
Ensure processor contracts meet Article 28 requirements
Assess vendors annually (high-risk: quarterly)

The Athlex Data Protection free audit highlights exactly where your vendor chain poses compliance risk.

ICO Enforcement Trend 4: Governance, Documentation & Accountability Are Under the Microscope

BDO’s report highlights that the ICO is increasingly examining how decisions are made, not just whether breaches occur. Good governance – leadership awareness, documented decisions, risk logs, and internal reporting structures — is now a major enforcement factor.

This aligns with the ICO’s call for views on new enforcement-procedural guidance, signalling more transparent and structured regulatory processes.

This means SMEs are expected to show:

clear data-protection ownership
leadership engagement
meaningful internal reporting
documented risk assessments and decisions
evidence of proactive compliance

How SMEs Can Stay Ahead – Starting Today

To prepare for these enforcement trends, SMEs should immediately focus on:
✔ DSAR workflows
✔ Data-accuracy controls
✔ Vendor oversight
✔ Incident readiness
✔ Governance documentation

And the simplest way to begin?

Use Athlex Data Protection’s Free UK GDPR Compliance Audit tool.

To read more about the biggest UK GDPR risks for SMEs, see our blog: Inside Out: Why Insider Risk Is the Biggest UK GDPR Blind Spot for SMEs.

It covers DSARs, access controls, vendor risk, system accuracy, governance, and incident readiness – all mapped into a clear action plan.

Understanding the Data (Use & Access) Act 2025: What UK Businesses Need to Know

5 minutes read

Why Was the DUAA Introduced?

The DUAA aims to modernise the UK’s data protection regime, ensuring that individuals have better control over their personal data while enabling organisations to innovate responsibly. It responds to new technologies, data‑driven business models and concerns about transparency. The Act builds on the UK GDPR framework rather than replacing it, so businesses must view it as complementary rather than separate.

Key Changes under the DUAA

1. Increased Fines for Electronic Marketing

The DUAA raises the maximum penalties for breaches of PECR. Companies can now face fines of up to £17.5 million or 4% of their global turnover, whichever is higher. This brings electronic marketing fines in line with those under the UK GDPR. Any business that sends marketing emails, texts or calls should review consent processes and records to ensure compliance.

2. New Rules Around Cookie Consent

The Act introduces stricter requirements for cookie consent under UK GDPR. Companies must ensure that cookie banners are clear and separate from other requests. Pre-ticked boxes and implied consent are not acceptable. People must have a genuine choice and be able to withdraw consent just as easily as they give it. Businesses should audit their cookie practices, update consent tools and keep records of consent.

3. Stronger Powers for the ICO

The Information Commissioner’s Office gains broader authority to compel businesses to provide information, reports and interviews as part of investigations. Failure to cooperate may lead to enforcement action. Businesses should keep thorough records of processing activities and be prepared to demonstrate compliance quickly if asked.

4. Expansion of Subject Access Rights

The DUAA reinforces the right to access personal data, requiring more detailed explanations of how data is used and shared. Organisations must be transparent about data sources and how decisions are made using personal data. This ties in closely with DSARs, making it even more important to have a robust process for responding to data requests.

5. Automated Decision‑Making Controls

The Act introduces new restrictions on automated decision‑making that significantly affects individuals. Businesses must provide human oversight, explain the logic behind decisions and allow individuals to contest them. Sectors using AI and machine learning—such as finance, insurance and recruitment—must ensure their systems meet these requirements.

Practical Steps to Comply

1. Audit Your Marketing Activities

Review how you collect and store consent for marketing communications. Ensure you can demonstrate a lawful basis for all electronic marketing. Update marketing databases to remove contacts without valid consent. For B2B marketing, confirm that you are complying with relevant exemptions and that messaging remains within legal boundaries.

2. Update Cookie Policies and Banners

Conduct a cookie audit to understand what tracking technologies your site uses and why. Update your cookie notice to clearly describe categories, purposes and retention periods. Implement a consent management platform if necessary, ensuring that individuals can easily change their preferences.

3. Strengthen Record‑Keeping

Maintain up‑to‑date records of processing activities, including data flows, legal bases, retention periods and third‑party sharing. If the ICO requests evidence of compliance, having organised records demonstrates accountability and saves time. Regularly review and update your records to reflect changes in processing.

4. Review Automated Decision‑Making Processes

Identify any processes that use algorithms or profiles to make decisions that could significantly affect individuals. Assess the legal basis for using automated decisions and whether human oversight is provided. Update privacy notices to explain these processes and develop procedures to address challenges from individuals.

5. Train Staff

Your employees are the first line of defence against non‑compliance. Provide training on the DUAA, focusing on marketing, cookie consent, data subject rights and automated decision‑making. Raise awareness of increased fines and the importance of cooperation with the ICO.

Impact on SMEs

Some SMEs might assume that new legislation primarily targets large corporations. However, the DUAA applies to any organisation processing personal data, regardless of size. Smaller businesses often have limited resources, making it harder to adapt. Yet the cost of non‑compliance—financial penalties and reputational damage—can be far greater than the cost of putting proper systems in place. SMEs should seek professional advice to interpret the Act and prioritise actions based on the data they handle.

How Athlex Supports Your Compliance

Staying on top of evolving data protection laws can be challenging. Athlex specialises in GDPR and privacy compliance for businesses of all sizes. Our consultants can help you conduct a DUAA readiness assessment, update policies and procedures, and train your staff. We provide practical, jargon‑free advice tailored to your industry, ensuring that you understand your obligations and can implement changes effectively. Whether you need a one‑off consultation or ongoing support through our outsourced DPO service, we make compliance manageable.

Looking Ahead

The DUAA is part of a broader trend toward stronger data governance. Businesses should expect further updates as technology evolves and public expectations of privacy grow. By understanding the DUAA and integrating it into your existing compliance framework, you prepare your business for future changes. Adopting a proactive approach—regular audits, employee training and transparent data practices—will position you as a trustworthy organisation in a competitive market.

Conclusion

The Data (Use & Access) Act 2025 introduces significant changes that businesses cannot ignore. Higher fines for marketing violations, tougher cookie rules, expanded subject rights and increased regulatory powers raise the stakes for data protection. By taking practical steps—auditing marketing activities, updating cookie banners, strengthening record‑keeping, reviewing automated decision processes and training staff—you can meet your obligations and build customer confidence. With professional guidance from Athlex, your business can turn compliance into a competitive advantage and navigate the evolving data protection landscape with confidence.

Sign up to our newsletter to receive updates directly to your inbox. You can also read more about DUUA updates to complaints processes in our blog.

Handling Data Subject Access Requests (DSARs): A Comprehensive Guide for SMEs

6 minutes read

Managing personal data responsibly is a legal requirement. Under the UK GDPR, anyone can request a copy of the personal data you hold about them and details of how you use it. This is called a data subject access request (DSAR). For SMEs, responding within the one-month deadline may feel challenging, but it is achievable. This guide explains your DSAR obligations, how to verify identity and gather data, and why prompt, compliant responses build trust.
REASON: The revised introduction introduces keywords like one-month deadline, DSAR obligations and verify identity. It provides clearer context and encourages readers by outlining benefits.

What Is a DSAR?

A DSAR is a request made by a person to obtain a copy of their personal data held by an organisation. It may also ask for details on how the data is processed, who it is shared with, the source of the data and how long it will be retained. Under the UK GDPR, organisations typically have one month to respond. In certain situations, you can extend this by two months, but you must inform the requester within the initial month and explain why. Failing to meet the deadline can lead to complaints and potential regulatory action, so timely responses are essential.

Who Can Make a DSAR?

Anyone can make a DSAR – customers, employees, suppliers or any individual whose data you process. The request doesn’t need to mention “DSAR” or cite the GDPR; it can be informal, verbal or written. Even a message on social media can count. Your responsibility is to recognise the request and handle it appropriately. Businesses should train staff to identify DSARs and direct them to the right person or team.

How to Respond to a DSAR

1. Verify Identity

Before disclosing personal data, verify the requester’s identity to prevent data breaches. If you’re not sure the person is who they say they are, ask for additional information such as a copy of an ID or details only the individual would know. Make sure your verification process is reasonable and proportionate; you shouldn’t request excessive or irrelevant documents.

2. Acknowledge Receipt

Send a prompt acknowledgement confirming you’ve received the request. Outline what you will do next, mention the one-month deadline and ask any clarifying questions if the request is vague. This sets expectations and demonstrates professionalism.

3. Gather Information

Identify all systems, databases and physical files where the requester’s personal data may be stored. This includes emails, customer relationship management (CRM) systems, cloud storage, paper records and any third-party processors you use. You must inform processors of the DSAR and ensure they supply relevant data.

4. Filter Data

Review the collected data and remove any information that is not personal data about the requester or that falls under exemptions. For example, data that identifies another individual may need to be redacted, or you may withhold information that’s legally privileged. Consult the UK GDPR and relevant guidance to determine what can be excluded.

5. Compile a Response

Prepare the data in an accessible format. Explain why you hold the data, the lawful basis for processing, how long you will retain it and who else it has been shared with. If the requester asked specific questions, address them. Provide the data securely—use encrypted email or secure download links – and clearly state how they can contact you for follow-up questions.

6. Keep Records

Document each DSAR you receive, including the date, actions taken, communications and final response. Good record-keeping helps demonstrate compliance if the Information Commissioner’s Office (ICO) investigates.

Why Efficient DSAR Handling Matters

Properly managing DSARs is not just about legal compliance; it’s a chance to build trust. Responding promptly and clearly shows that you respect individual rights. It also helps you maintain accurate records, which can improve overall data governance. Moreover, DSARs can highlight gaps in your data protection processes, prompting improvements. Finally, efficient DSAR handling minimises the risk of fines and reputational damage from mishandled requests.

Tips for Streamlining DSAR Processes

Train Staff: Make sure employees understand what a DSAR is and whom to contact if they receive one.
Develop a Standard Procedure: Create a step-by-step guide for handling requests, including templates for acknowledgements and responses.
Use Data Mapping: Maintain an up-to-date record of where personal data is stored to save time when collecting information.
Automate Where Possible: Consider using data discovery tools or DSAR management software to help identify and compile data.
Plan for Complex Requests: Some requests may be broad or require input from multiple departments. Having a plan in place reduces delays.

Common Mistakes to Avoid

Missing the Deadline: Start the process as soon as you receive a request. Even if you don’t have all the data yet, communicate progress and explain any delays.
Overlooking Data Held by Third Parties: Remember that data processors are part of your supply chain. You remain responsible for data held on your behalf.
Sharing More Data Than Necessary: Only provide data relating to the individual. Avoid disclosing information about other people or proprietary business information.
Charging a Fee: DSARs are usually free. You can only charge a reasonable fee in certain circumstances, such as repeated requests or excessive volumes of data.
Ignoring Informal Requests: A DSAR doesn’t have to mention the GDPR. Recognise any request for personal data as potentially valid and treat it accordingly.

How Athlex Can Help

Handling DSARs can be time-consuming and complex, especially for SMEs with limited resources. Athlex provides tailored support to ensure your DSAR responses are compliant and efficient. Our consultants can help you set up a procedure, train staff, and even manage requests on your behalf. From verifying identity to drafting clear responses, we offer the peace of mind that comes with expert guidance. Working with our outsourced Data Protection Officers (DPOs) means you can focus on your core business, knowing that data subject rights are respected.

Conclusion

A well-handled DSAR is a sign of a mature data protection practice. By following a clear process verifying identity, gathering and filtering data, and responding within the legal timeframe you can comply with your obligations and build trust with your customers and employees. Investing in good DSAR management now will pay dividends in the long run, reducing risk and strengthening your organisation’s data governance.

Read our blog http://athlex.co.uk/when-enforcement-isnt-enough-what-bristols-transparency-failures-teach-us-about-foi-dsars-and-accountability/ to find out what might happen if you get DSARs wrong.

The 72 Hour Rule for UK GDPR Breach Reporting

5 minutes read

The 72 Hour Rule for UK GDPR Breach Reporting: A Plain English Guide for SMEs

When a personal‑data breach occurs, there are two key questions:

When must we notify the regulator?
How should we handle things internally to reduce risk, cost and reputational damage?

Lately, it feels like data breaches are never out of the headlines. From Marks & Spencer’s loyalty leak to Jaguar Land Rover’s ransomware hit, UK businesses are being tested on how fast and how well they respond.

For SMEs, understanding the 72‑hour rule under the UK GDPR isn’t just about avoiding fines it’s your fire drill, your buffer, your business continuity plan.

What is a “personal data breach”?

A personal data breach under the UK GDPR is any security incident that results in:

Accidental or unlawful destruction or loss of personal data
Loss of availability, for example through ransomware or system failures
Alteration or corruption of data that makes records inaccurate
Unauthorised disclosure of, or unauthorised access to, personal data

It doesn’t take a hacker, mis-sent emails, misplaced USB drives, or wrongly configured cloud folders all qualify.

The “72-hour rule” – what it really means

The law doesn’t give you three full days to get your act together. It says:
“Without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.”

That means:

If you can report sooner, you should.
If you miss the deadline, you must justify why.
And no – “we were still checking with IT” won’t cut it.

Step-by-step: what SMEs should do

✅ Recognise the incident

Use monitoring, logging, and staff escalation to detect breaches fast.

✅ Assess the risk

Ask: what is the risk to the individual, is there a risk of identify fraud, financial or physical harm or distress. We provide more guidance on this below.

✅ Decide whether to report to the ICO

Ask; what is the harm to the individual(s)? And decide if you need to report the breach. If you are not reporting, you must keep a log, with clear reasoning.

✅ Notify the regulator if likely to result in a risk of harm to individuals

Use the ICO breach reporting form and include:

What happened
What data and the number of people affected
Consequences
What you have done to reduce the risks
DPO or contact point

✅ Notify individuals (if high risk)

If the breach presents a high risk to the people affected (e.g. financial, reputational or emotional harm), you must tell them directly – without undue delay. This could be where there is an immediate risk of financial or physical harm to an individual.

✅ Remediate and document

Do a root-cause review to be clear about why it happened and how you will prevent it happening again. Update controls. Train staff. Write it all down.

Is the breach reportable? How to decide

Not every breach needs to be reported to the ICO – but many are. And the line between “notify” and “log it internally” isn’t always obvious.

Under the UK GDPR, a breach must be reported to the regulator if it is:

“likely to result in a risk to the rights and freedoms of individuals.”

This includes risks like:

Identity theft or fraud
Financial loss
Loss of confidentiality
Discrimination or reputational harm
Distress, particularly where vulnerable people are affected

But what does “likely” mean in practice?

That’s where judgment, experience, and knowledge of ICO enforcement comes in. You’ll need to assess:

What kind of data was involved? (Basic contact details or sensitive health, financial, or identity data?)
How exposed was it? (Sent to one person or published online?)
How long was it accessible?
Is there evidence it was accessed or misused?
Could individuals suffer harm or distress as a result?

This isn’t a binary “yes/no” — it’s a context-led risk decision. And it’s one the ICO expects you to document thoroughly.

💡 If you decide not to report, you still need to record:

The nature of the breach
The decision-making process
Why you believe notification wasn’t required
Any steps taken to contain or prevent recurrence

📚 Many SMEs benefit from looking at recent ICO cases, guidance, and fines. These real-world examples show how risk is interpreted — and where organisations got it wrong by waiting too long, misjudging impact, or failing to document decisions.

🗂️ Bottom line: if you’re unsure, log your reasoning and seek advice. Whether you notify or not, the ICO cares most about whether you acted promptly, documented clearly, and protected individuals’ rights.

Common SME mistakes

No breach detection tools in place
Waiting too long to decide what to do
Not documenting decisions
Assuming “we’re too small to be a target”
Launching new systems without updating privacy notices or contracts

Why SMEs should care

📣 From M&S to Jaguar Land Rover, breaches are everywhere.

But the risk isn’t just for corporates:

SMEs are common stepping stones in larger supply chains
Many attacks fly under the radar but cause huge disruption
The ICO doesn’t care how small you are if you’re unprepared

💥 Capita was fined £14m for poor breach handling.
🧾 Don’t wait for yours to become a headline.

SME breach-response checklist

Do you have a documented, tested response plan?
Are your logs and alerts functioning?
Have staff been trained on what to do?
Do your contracts cover breach reporting?
Do you review and record every incident, even the “minor” ones?

Related on Athlex: Prevent insider risk

Most breaches start from inside your business.
📘 Read: Insider Risk — 7 GDPR Controls for SMEs

Final word

The 72-hour rule is not just a regulatory tick-box it’s your first defence.

Plan it. Test it. Use it.
And when a breach happens, act fast and document everything.

Inside Out: Why Insider Risk Is the Biggest UK GDPR Blind Spot for SMEs

5 minutes read

The risk that sits at your own desk

Most data incidents don’t start with outsiders. They start with someone who already has access: an employee exporting a list to a personal inbox “to finish later,” a contractor browsing records “out of curiosity,” or a former staff member whose account was never disabled. The UK Information Commissioner’s Office (ICO) expects organisations to prevent this through proportionate technical and organisational measures, and to assess and report personal data breaches appropriately. See the ICO’s guidance on personal data breaches.

Insider risk is the gap between “we have policies” and “we actually control who can see what, when, and why.” This guide turns that gap into seven practical controls you can implement this quarter.

7 Practical UK GDPR controls to reduce insider risk

1) Least-privilege access with clean joiner/mover/leaver (JML) flows

Do this:

Map each role to specific datasets and grant only the minimum access required.
Automate joiner, mover and leaver provisioning through your HRIS so accounts are created and removed promptly.
Ban shared credentials and require multi-factor authentication on every account.

Outcome: Access is limited to what’s necessary, changes are applied promptly when people join, move or leave, and you can evidence necessity and proportionality under UK GDPR security and privacy-by-design requirements.

2) Evidence you can trust: logs and audit trails

Do this:

Log views, exports, deletions and permission changes across core systems.
Centralise logs and alert on unusual patterns, such as mass lookups or out-of-hours exports.
A Security Information and Event Management tool helps, but start with built-in logs if that’s what you have.

Outcome: You can confirm what happened quickly, assess risk to individuals, and make accurate, timely notification decisions.

3) Stop the leak before it starts: Data Loss Prevention (DLP) and redaction

Do this:

Configure DLP rules for email, cloud storage and endpoints.
Auto-redact sensitive fields in routine exports and reports.

Outcome: Accidental oversharing is blocked by default, and special category data stays tightly controlled.

4) Device and workspace controls that actually work

Do this:

Enrol all company and Bring Your Own Device (BYOD) endpoints in Mobile Device Management (MDM). Require disk encryption and screen lock.
Disable local downloads for high-risk roles; restrict screenshots or copy/paste in sensitive apps where feasible.

Outcome: Data remains in managed environments and is harder to extract via quick workarounds.

5) Processor hygiene: vendor minimums and escalation paths

Do this:

Bake minimum security measures, prompt breach notification, and audit rights into processor contracts.
Maintain a single vendor risk register with owners and review dates.

Outcome: Third parties stop being “insiders by proxy” without accountability, and you have a clear path when something goes wrong.

6) Behaviour beats posters: training, nudges and sanctions

Do this:

Run short, role-based refreshers using the workflows your teams actually use.
Add in-tool nudges: “This export contains personal data. Do you need names?”
Publish and apply a proportionate sanctions policy for misuse.

Outcome: People make better choices at the point of risk, and expectations are unambiguous.

7) Drill it: a 60-minute insider-incident playbook

Do this:

Write a one-page runbook. Simulate it quarterly.
Define who freezes access, who gathers evidence, who communicates to customers, and who speaks to the ICO.

Outcome: Response is coordinated and timely, with decisions recorded and defensible. Use the ICO’s security guidance hub to shape your thresholds and evidence checklist.

Why this matters: real-world expectations

Enforcement keeps landing where staff accessed records without a valid reason. Recent prosecutions include healthcare workers fined for snooping in patient records, underlining the need for access controls and audit trails. Example: ICO case report, Former NHS secretary found guilty of illegally accessing medical records.

For technical mitigations that specifically target insider misuse and data exfiltration, the National Cyber Security Centre (NCSC) provides concrete advice you can layer on top of policy and training: Reducing data exfiltration by malicious insiders.

The 60-minute plan when insider misuse is suspected

Contain: Freeze the account, revoke tokens, stop syncs.
Preserve evidence: Snapshot logs and systems before making changes.
Scope: Identify what data, which data subjects, the lawful basis and intended purpose.
Assess risk and notify if required: Inform affected individuals and the ICO based on risk to rights and freedoms, following the ICO’s thresholds and timelines.
Document: Record decisions, timestamps, and people involved in your breach register.
Remediate: Fix process gaps; update DLP rules and training.
Follow-up: Close similar access gaps across roles and vendors; verify offboarding is watertight.

What to do this month: a 30-day insider risk checklist

Access reviews on all high-risk systems
JML automation turned on for HRIS and your Identity Provider (IdP)
Export and bulk-view logging with alerts
DLP pilot on email and cloud storage
Processor addendum with breach information schedule
Role-based refreshers booked
One tabletop drill with your leadership team
Validate your approach against the NCSC insider-exfiltration guidance

If you outsource checks or verification, you still carry the risk. Read out guide: Age verification and the UK GDPR in 2025: a plain-English SME guide.

Other things you can do:

Get cover: Our Outsourced DPO service keeps these controls live, not just on a slide
Talk to us: email us hello@athlex.co.uk to find out how we can help you

Age verification and UK GDPR in 2025: a plain-English SME guide

4 minutes read

If your product or community has age-limited features, you’ve probably looked at third-party age-verification (AV) tools. They can help with fast onboarding and higher assurance. They do not remove your responsibilities as a controller. A recent breach at a third-party provider handling age-check appeals is a reminder to tighten the basics.[i]

Below is a practical checklist you can apply this week.

1) Refresh your DPIA

Treat AV as a distinct processing activity. Update your Data Protection Impact Assessment (DPIA) with:

(a) categories of data the vendor collects, such as ID images and metadata,

(b) special-category or child considerations,

(d) mitigations such as encryption, redaction, and retention controls. If you still identify high risks you cannot reduce, you must consult the ICO before you go live.[ii]

2) Get serious about processor due diligence

At a minimum, send potential vendors a security questionnaire covering access controls, key management, encryption at rest and in transit, and relevant certifications. Request a full list of sub-processors and evidence of breach management. Your contracts should mandate prompt breach notification, co-operation with investigations, approval of any sub-processor, transparency about data locations and robust audit rights. Many age-verification providers use third-party image-processing pipelines, so insist on visibility and the right to object to high-risk practices.

3) Data minimisation and retention

Only collect what you need to achieve the purpose. Prefer a pass or fail token and a coarse age band over storing full ID images. Where images are necessary, for example during appeals, set short retention periods and automatic deletion. Avoid internal copies of vendor-held data. Ask for privacy-preserving artefacts such as non-reversible tokens or signed assertions to prove checks occurred.

4) Build a clean incident playbook

Your playbook should name decision-makers in legal, PR, engineering, and security. Include steps to cut off the vendor, rotate keys, revoke scopes, switch to a fallback path, and notify affected users where required. Prepare clear comms templates and support routes. Rehearse the cut-over at least once a year.

5) Children and higher-risk contexts

If your service is likely to be accessed by children, align with the ICO’s Children’s Code. That means high privacy by default, clear and age-appropriate information, and DPIAs that reflect child-specific risks. In AV flows, design for dignity and accessibility. Offer alternatives for people who do not have passports or driving licences. Start with the ICO’s code and standards.[iii]

6) Understand DUAA timing and what changes

The Data (Use and Access) Act 2025 is being switched on in stages. Expect the main data-protection changes about six months after Royal Assent. The new duty to provide a data-protection complaints route is expected about twelve months after Royal Assent. Keep a simple internal timeline, assign owners, and log milestones such as policy updates, training, and website notices. See the government’s commencement plan[iv] and the ICO’s explainer.[v]

7) Recognised Legitimate Interests (RLI): plan, do not assume

RLI is a new lawful basis that will apply to specific public-interest purposes once commenced. Most commercial AV uses will still rely on consent, contract, or legitimate interests with a proper balancing test. Track the ICO’s draft guidance and plan a gap-analysis workshop when the final text lands.[vi]

8) Communicate clearly

Update your privacy notice with a dedicated AV section covering purpose, data types, vendor names, locations, retention, and user choices. Provide a one-screen summary in the AV flow with a link to full details. Make it obvious how people can raise a data-protection complaint with you now and how you will meet the new statutory process once it is in force.[vii]

9) Test your fallback

If the vendor goes down or trust is lost, what then? Offer a temporary pathway, for example age-band self-declaration with heightened moderation, or a pause with email support, while you switch vendors. Document the lawful basis for your fallback and the short-term risk trade-offs you accept.

Quick win checklist

DPIA updated and signed off
Processor due diligence complete and sub-processors logged
Retention periods implemented and images set to auto-purge
Incident playbook rehearsed and vendor cut-off tested
Privacy notice section live and complaints route visible
DUAA milestones tracked and training booked

[i] The Guardian

[ii] ICO: when prior consultation is required; DPIA overview.

[iii] Children’s Code hub

[iv] DSIT commencement guidance

[v] ICO: what DUAA means

[vi] ICO consultation on RLI)

[vii] ICO consultation on complaints handling

A Complaints Revolution?

6 minutes read

What the Data (Use & Access) Act 2025 Means for Your Business

The UK’s data protection rules are changing again. Here’s what small and medium-sized businesses need to know about the new legal duty to handle data protection complaints and how to get ready.

Why this matters

The Data (Use & Access) Act 2025 introduces a major new responsibility for UK businesses. For the first time, organisations will be legally required to have a formal process for handling data protection complaints.

This means every business that processes personal data will need a clear way for people to raise concerns, and a plan for how those complaints are recorded, investigated and resolved.

The change builds on the existing UK GDPR and Data Protection Act 2018. It does not replace them, but it strengthens the rules around accountability and response times. The goal is simple: to make sure individuals can trust that their data rights are taken seriously.

If your business already manages data protection complaints properly, this may only mean a few small updates. But if you currently respond on an ad-hoc basis or tend to dismiss complaints that seem unfounded, it is time to make changes now.

The new duty in a nutshell

The Act received Royal Assent on 19 June 2025 and is being introduced in stages. The key stage for most organisations, current expected around 12 months from Royal Asset (so around mid- 2026), is the new legal duty to handle complaints.

Under this duty, you will need to:

Acknowledge data-protection complaints within 30 days and tell people what will happen next
Investigate and respond promptly, without unnecessary delay, explaining the outcome in plain language
Record every complaint and document how and when it was resolved
Train staff to recognise, log and properly escalate data-protection complaints

These rules apply to all organisations that process personal data, regardless of size or sector.

You can read the official rollout plan on GOV.UK https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement

Two ICO consultations shaping the change

The Information Commissioner’s Office (ICO) is currently running two consultations to help define what “good” looks like in complaint handling.

Guidance for organisations, explaining how to set up and manage a complaint-handling process.
Deadline: 19 October 2025
ICO Consultation on Complaints Guidance for Organisations
The ICO’s own complaint-handling framework, which outlines how the regulator will assess and respond to complaints once the law is in force.
Deadline: 31 October 2025
ICO Consultation on Changes to How We Handle Data Protection Complaints

The first consultation tells you what your business needs to do. The second explains how the ICO will respond to complaints and what data they will monitor.

The risk of inaction

This is more than a procedural update. The ICO has made it clear that it will monitor complaint trends across sectors. Repeat or unresolved complaints could attract attention and follow-up engagement from the regulator.

If you do not have a reliable process in place, the risks include:

Reputational damage if complaints are mishandled or ignored
Evidence gaps that make it difficult to show compliance
Closer scrutiny if your business appears in repeated complaint reports

Even complaints that seem minor or unjustified must be logged and responded to. If you choose to ignore them, they will still count towards your complaint history. The ICO will be looking for businesses that can show they act on feedback, not those that hope issues go away.

If you already manage complaints effectively, you are in a good position. If not, now is the time to act. Setting up a clear process will protect both your reputation and your compliance record.

What good looks like

A compliant complaint-handling process should feel simple and transparent. It should show that you take customers seriously and can evidence your actions.

The ICO’s guidance suggests focusing on:

Visibility: make it easy for people to raise a concern, for example by publishing contact details or a form in your privacy notice.
Consistency: respond within set timeframes and keep records of all correspondence.
Evidence: log complaints in a way that allows you to track progress, outcomes and lessons learned.
Governance: review complaint trends regularly to identify recurring issues or training needs.

If you already have a process in place, check that it meets these standards and that your team understands it. If you do not, start simple. A shared inbox and a basic log are often enough for smaller businesses, as long as they are used consistently.

The bigger picture

The new complaint-handling duty is part of a wider move towards greater accountability and user empowerment. Alongside this, the ICO has been setting out its approach to user consent, transparency and digital choice – including its views on Meta’s “consent or pay” advertising model.

Both developments point in the same direction. The UK is not deregulating data protection; it is making it more practical. The focus is on evidence and accountability – being able to show not just that you comply, but that you care about how personal data is handled.

What to do next

If you are unsure where to start, focus on these steps:

Create or review your complaint process.
Have a clear route for people to raise issues, assign responsibility and set timeframes for acknowledgement and response.
Keep records.
Track all complaints, even if you think they lack merit. Record what was done, what you found and how you closed the issue.
Update your privacy notice.
Tell people how they can raise a complaint and what they can expect from you in return.
Train your team.
Make sure everyone who handles customer or employee data knows how to recognise and escalate a data protection complaint.
Review contracts.
Ensure any partners or suppliers who handle personal data know their role in your complaint-handling process.
Monitor and improve.
Look for recurring issues or delays. Fixing small process gaps now will reduce the risk of ICO involvement later.

How Athlex can help

At Athlex, we make compliance clear. We help businesses build practical, proportionate frameworks that work in the real world.

Our services include:

Designing or reviewing complaint-handling frameworks
Providing outsourced Data Protection Officer (DPO) support
Reviewing contracts and supplier arrangements
Updating privacy notices and policies
Delivering tailored training and audits for your team

If you would like help reviewing your approach to complaints, start with a free GDPR Health Check. We will show you where you stand, what is working well and what to fix first.

Book your free data protection health check.

In summary

The Data (Use & Access) Act 2025 is not a complete rewrite of data protection law, but it will change how accountability is judged.

Businesses with clear, consistent complaint-handling processes will adapt easily. Those without one will need to move quickly. Ignoring complaints – even the unfounded ones – will no longer be an option.

Taking action now will save time later and show your customers that you value their trust.

When Enforcement Isn’t Enough: What Bristol’s Transparency Failures Teach Us About FOI, DSARs and Accountability

4 minutes read

Enforcement notices from the ICO are supposed to be the stick that ensures compliance. Yet Bristol City Council’s recent history shows us something worrying when enforcement becomes repetitive, it starts to look less like a deterrent and more like a cycle.

In March 2024, the ICO issued an enforcement notice against Bristol for a backlog of 158 Freedom of Information (FOI) requests.[i] The council’s recovery plan stretched to 39 months, almost ten times longer than the legal 20 day deadline. The First-tier Tribunal upheld the ICO’s intervention, but the backlog remains a public embarrassment.[ii]

Just over a year later, the ICO issued a separate enforcement notice against the council over Data Subject Access Requests (DSARs). The issue was the same: unanswered requests, missed deadlines, lost trust.[iii]

The Limits of ICO Enforcement

This is not the first time the ICO has issued enforcement notices to public bodies over transparency failures, and it will not be the last. The regulator’s powers often stop at setting deadlines and demanding reports. Rarely do we see financial penalties, and the cultural problems of under-resourcing, deprioritisation, and avoidance of scrutiny, go unaddressed.

The result? Organisations can stumble from one enforcement notice to the next. Citizens are left waiting. Trust erodes further.

FOI and DSARs: Two Sides of the Same Coin

FOI is about public transparency; DSARs are about personal transparency. Both are legal rights that anchor accountability. When organisations fail to comply with either, it’s not just a missed deadline, it’s a missed opportunity to show integrity.

Bristol’s dual failures highlight a dangerous culture: treating transparency duties as administrative burdens rather than core governance responsibilities.

Why This Matters for Your Organisation

If you think this is just a local authority problem, think again.

Courts are raising the stakes: In Ashley v HMRC[iv], the High Court criticised HMRC for confining its data search to one division while ignoring related data held by another. The judgment made clear that controllers must take a holistic view of their data estate, not artificially silo their searches.
The ICO is under pressure: Facing increased criticism of its lack of enforcement abilities, expect more enforcement not less as the regulator seeks to prove its credibility.[v]
Stakeholders notice: Delays and failures affect customers, employees, investors, and regulators alike. Ultimately it can lead to costly complaints, loss of trust and action against you, both legal and regulatory.

The message is clear: the cost of poor compliance is not just regulatory, it’s reputational and commercial.

Breaking the Cycle

Enforcement may expose failure, but it does not build resilience. That’s where organisations need to step up. The question is: do you want to be forced into compliance under the spotlight of an ICO notice (whether lacking in teeth or not) or build processes now that make enforcement unnecessary?

At Athlex, we help organisations:

Design robust DSAR processes that withstand regulatory scrutiny.
Train staff to spot and respond to requests promptly.
Build governance frameworks that treat transparency as a strength, not a risk.
Anticipate ICO expectations before they become enforcement notices.

The Bottom Line

Bristol’s story shows that enforcement alone won’t save an organisation from reputational damage. The only real solution is cultural and operational change done before the regulator knocks on the door.

The ICO may be raising its voice, but the real question is: will your organisation be next on the list, or will you break the cycle?

References

[i] Bristol City Council Enforcement Notice, ICO (14 March 2024) https://ico.org.uk/action-weve-taken/foi-regulatory-action/2025/02/bristol-city-council/

[ii] Bristol City Council v Information Commissioner [2025] UKFTT 948 (GRC) https://caselaw.nationalarchives.gov.uk/ukftt/grc/2025/948

[iii] Bristol City Council Enforcement Notice, ICO (27 August 2025) https://ico.org.uk/action-weve-taken/enforcement/2025/09/bristol-city-council/

[iv] [2025] EWHC 134 (KB)< https://www.judiciary.uk/wp-content/uploads/2025/01/Ashley-v-HMRC.pdf>

[v] See for example https://www.linkedin.com/pulse/icos-collapse-shows-its-longer-fit-purpose-john-barwell-vecje/