Blog
Rebuilding lives after brain injury: the role of the Court of Protection
Jemma Garside
14 May 2026
Why every technology strategy needs an exit plan
Most technology strategies spend a lot of time on adoption. Very few spend enough time on exit.
28 April 2026
When can organisations rely on “consent” under data protection laws? The Court of Appeal clarifies in RTM v Sky Betting and Gaming
The Court of Appeal's recent decision in RTM v Bonne Terre Limited & Hestview Limited [2026] EWCA Civ 488 is an important one for any business/controller that relies on consent as a lawful basis for processing personal data or sending direct marketing communications. In short, the legal test for consent under data protection legislation is an objective one, not a subjective inquiry into the data subject’s internal state of mind.
28 April 2026
“Recruitment Rewired”: what employers need to know about automated recruitment
On 31 March 2026, the Information Commissioner’s Office (ICO) published its Report, “Recruitment Rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment”, setting out its findings and regulatory expectations for employers using AI‑enabled or automated tools in recruitment.
27 April 2026
Employment law changes tech businesses need to know about
A significant number of employment law reforms are coming into effect in 2026 and 2027 following the introduction of the Employment Rights Act 2025 at the end of last year.
20 April 2026
Court of Appeal confirms scope of data controllers’ security obligations
In a recent decision, the Court of Appeal allowed the UK Information Commissioner's appeal against the decision of the Upper Tribunal in proceedings involving DSG Retail Limited ("DSG"). The case arose from a nine-month cyber-attack in 2017-2018 on DSG’s systems, during which the attackers scraped transaction data from point-of-sale terminals from over 5.6 million payment cards. The compromised data included card numbers and expiry dates but not cardholders' names, meaning the attackers could not directly identify individuals from the data alone.