UK GDPR diverges from EU GDPR in AI guidance, adequacy decisions, and enforcement priorities.
The Challenge
UK GDPR (UK Data Protection Act 2018) mirrors EU GDPR with key post-Brexit differences: the ICO has issued its own AI guidance (2024 Guidance on AI and Data Protection) that explicitly addresses generative AI, which is more detailed than EU guidance. The ICO fined LastPass UK £1.2M in December 2025 for inadequate encryption — a landmark technical security enforcement case. UK's adequacy decision with the EU remains valid as of 2025 but faces ongoing legal challenge.
By the Numbers
- £1.2M ICO fine against LastPass UK December 2025 for inadequate encryption (ICO enforcement notice)
- ICO issued 67 enforcement notices in 2024 — record high (ICO Annual Report 2024)
- UK GDPR maximum fine: £17.5M or 4% global revenue
- ICO AI guidance covers 8 specific technical requirements for generative AI systems
Technical Approach
ICO's LastPass enforcement establishes that client-side encryption is a legal requirement, not optional. anonym.legal's zero-knowledge architecture directly satisfies ICO's technical security expectations for encryption tools.
Comments (0)