---
title: "United Kingdom — Sectoral Watch | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/sectoral-watch/
source_html: /jurisdictions/united-kingdom/sectoral-watch/index.html
description: "United Kingdom — Sectoral Watch (Amber, 7 sub-modules, 5 claims): Telecoms/ePrivacy and employment ADM are well evidenced; financial, health, credit, education and insurance sub-modules carry material gaps requiring escalation."
generated_at: 2026-10-25T04:46:50Z
content_sha256: a2401cc5013018ab279eee847877a4a4852bc14edff466c9ac2aec29057d1627
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Sectoral Watch | Data Protection Monitor

### D6Sectoral Watch7 sub-modules5 claimsAmber▾#

Telecoms/ePrivacy and employment ADM are well evidenced; financial, health, credit, education and insurance sub-modules carry material gaps requiring escalation.

Primary framework PECR 2003 (as amended by DUAA 2025); UK GDPR sectoral guidance

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Amber Telecoms/ePrivacy and employment ADM are well evidenced; financial, health, credit, education and insurance sub-modules carry material gaps requiring escalation.

#### Sub-modules (7)

Category narrative 188 words

Sectoral overlays reinforce the horizontal UK GDPR/DPA 2018 baseline across financial services, health, telecommunications, employment, credit reporting, education, and insurance. In financial services, the FCA andICO coordinate under their Memorandum of Understanding on Consumer Duty (PRIN 12 / PRIN 2A), AI governance, and open banking / Smart Data schemes under DUAA 2025 Part 1 (ss.1–26). In health and social care, UK GDPR Art. 9(2)(h)–(j) and DPA 2018 Sch. 1 operate alongside the common law duty of confidentiality, the National Data Opt-Out, Caldicott Principles, and DUAA 2025 Part 2 health IT interoperability standards. Telecommunications and electronic communications are governed by PECR 2003 (as amended by DUAA 2025 Part 5, raising maximum PECR penalties to UK GDPR levels from 5 February 2026) and the Communications Act 2003 supervised jointly with Ofcom. Workplace monitoring, employee DSARs, health records, and algorithmic HR tools are governed by the ICO Employment Practices Data Protection Guidance. Credit reference agencies operate under the Consumer Credit Act 1974 (s.157–159 statutory credit-file access and correction) alongside ICO Credit Explained principles, while insurance underwriting relies on DPA 2018 Schedule 1 Part 2 para. 20 (insurance substantial public interest condition).

Evidence 5

Sources and claims (5)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/action-weve-taken/enforcement/2026/05/kra-consultancy-ltd-mpn/) — The ICO fined KRA Consultancy Ltd £300,000 for sending over 5.5 million unsolicited direct marketing and fake bailiff texts in breach of regulations 22 and 23 of PECR, generating over 60,000 complaints to the 7726 spam-reporting service.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/schedules/) — The DUAA inserts a new schedule into PECR setting out exceptions from the prohibition on storing or accessing information on a subscriber's or user's terminal equipment (the cookie rules).observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/) — UK GDPR Article 22A defines automated decision-making (ADM) as a decision based solely on automated processing with no meaningful human involvement that has a legal or similarly significant effect on a person.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/) — The ICO wrote to 16 organisations likely using ADM in hiring, securing commitments to improve transparency, bias monitoring and human-review safeguards following a March 2026 compliance report.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/) — The ICO publishes dedicated FAQs applying the Children's code (Age Appropriate Design Code) to schools and education technology providers.observed 2026-07-28