Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Kingdom (UK) · Module Detail

United Kingdom: Sectoral Watch

← Full United Kingdom overview Build report with United Kingdom Request deeper dive

#

Telecoms/ePrivacy and employment ADM are well evidenced; financial, health, credit, education and insurance sub-modules carry material gaps requiring escalation.

Primary frameworkPECR 2003 (as amended by DUAA 2025); UK GDPR sectoral guidance
Supervisory authorityInformation Commissioner's Office (ICO)
Traffic-light rationale — AmberTelecoms/ePrivacy and employment ADM are well evidenced; financial, health, credit, education and insurance sub-modules carry material gaps requiring escalation.

Sub-modules (7)

Category narrative188 words

Sectoral overlays reinforce the horizontal UK GDPR/DPA 2018 baseline across financial services, health, telecommunications, employment, credit reporting, education, and insurance. In financial services, the FCA andICO coordinate under their Memorandum of Understanding on Consumer Duty (PRIN 12 / PRIN 2A), AI governance, and open banking / Smart Data schemes under DUAA 2025 Part 1 (ss.1–26). In health and social care, UK GDPR Art. 9(2)(h)–(j) and DPA 2018 Sch. 1 operate alongside the common law duty of confidentiality, the National Data Opt-Out, Caldicott Principles, and DUAA 2025 Part 2 health IT interoperability standards. Telecommunications and electronic communications are governed by PECR 2003 (as amended by DUAA 2025 Part 5, raising maximum PECR penalties to UK GDPR levels from 5 February 2026) and the Communications Act 2003 supervised jointly with Ofcom. Workplace monitoring, employee DSARs, health records, and algorithmic HR tools are governed by the ICO Employment Practices Data Protection Guidance. Credit reference agencies operate under the Consumer Credit Act 1974 (s.157–159 statutory credit-file access and correction) alongside ICO Credit Explained principles, while insurance underwriting relies on DPA 2018 Schedule 1 Part 2 para. 20 (insurance substantial public interest condition).

Sources and claims (5)
  1. ConfirmedInformation Commissioner's Office — The ICO fined KRA Consultancy Ltd £300,000 for sending over 5.5 million unsolicited direct marketing and fake bailiff texts in breach of regulations 22 and 23 of PECR, generating over 60,000 complaints to the 7726 spam-reporting service.observed
  2. ConfirmedInformation Commissioner's Office — The DUAA inserts a new schedule into PECR setting out exceptions from the prohibition on storing or accessing information on a subscriber's or user's terminal equipment (the cookie rules).observed
  3. ConfirmedInformation Commissioner's Office — UK GDPR Article 22A defines automated decision-making (ADM) as a decision based solely on automated processing with no meaningful human involvement that has a legal or similarly significant effect on a person.observed
  4. ConfirmedInformation Commissioner's Office — The ICO wrote to 16 organisations likely using ADM in hiring, securing commitments to improve transparency, bias monitoring and human-review safeguards following a March 2026 compliance report.observed
  5. ConfirmedInformation Commissioner's Office — The ICO publishes dedicated FAQs applying the Children's code (Age Appropriate Design Code) to schools and education technology providers.observed