Welcome to August’s Data Protection Monthly Newsletter. This month, we’re sharing fresh insights, recent developments, and the latest updates from the iSTORM team. Dive in to discover what’s happening and how you can keep strengthening your approach to data protection in 2026.
iSTORM Updates
July was another busy month at iSTORM, with ongoing client projects alongside and proposals coming in for support with GDPR, Penetration Testing, Cyber Essentials, and ISO services. Our team successfully completed an ISO 27001 audit for a new client, supported additional ISO clause audits, and continued to see growing demand for our DSAR and Data Protection Incident response services.
Alongside these larger projects, our Data Protection team continued to deliver day-to-day support, including DPIAs, RoPA reviews, and ongoing GDPR advice to clients.
Thank you, as always, for your continued support. We hope you’ve had the chance to enjoy some of the recent sunshine and look forward to sharing more updates next month.
Data Usage and Access Act 2025
- Data protection complaints process now mandatory: Organisations must have a formal complaints process in place, including acknowledging complaints within 30 days and providing outcomes.
- ICO guidance continues: The ICO published further guidance on DUAA implementation, covering complaints, SARs, and accountability.
- Automated Decision-Making (ADM): Organisations are reviewing ADM processes under the new safeguards-based framework introduced by the DUAA.
- Stronger PECR enforcement: Higher fines now apply for breaches relating to electronic marketing and cookies.
- UK and EU GDPR divergence: Organisations operating across both jurisdictions should review compliance against each framework.
- International transfers: Many organisations continue updating transfer assessments and accountability documentation to reflect the latest DUAA changes.
You may also need a Data Protection Complaints Policy, updates to your Privacy Notices, staff training on recognising and handling complaints, and contract amendments requiring processors to support this process.
If you would like any more information about this, or anything covered in this month’s newsletter, please reach out to us!
Update Bank Details
Update Bank DetailsA reminder that iSTORM has changed its primary bank account. If you need our updated banking details resent, please get in touch.
News
ICO updates right to object guidance
The ICO has refreshed its guidance following the Data (Use and Access) Act 2025. Organisations should ensure privacy notices and internal processes clearly explain the right to object, particularly for direct marketing and legitimate interest processing, and review marketing suppression procedures to prevent opted-out individuals from being contacted again. Source: PDP
ICO explores public expectations for neurotechnology
The ICO has released research into public attitudes towards neurotechnology and neurodata. This is an emerging but potentially highly intrusive category, capable of revealing aspects of a person’s health, mental state or behaviour. Organisations considering brain-monitoring or neurotechnology products should begin with necessity and proportionality, treat claimed consent with care, particularly in employment, and undertake a Data Protection Impact Assessment before procurement or testing begins Source: PDPP
Training
Did you know it’s a legal requirement to ensure all employees and contractors are trained to handle personal data? From GDPR principles to breach response, data requests, and remote working, it’s your responsibility, and you must be able to evidence it.
iSTORM can help with bespoke training in any format: HR packs, team sessions, in-person workshops, or even voice-over training for your internal LLM. Don’t get caught out—proper training is the first thing regulators will ask for if something goes wrong.
Talk to us about what support we can provide!
Meet the Team…
Our friendly team of passionate Data Protection Specialists are here to help your team navigate your data protection challenges, and are happy to support you with all your queries.
More from iSTORM?
We can offer services including:
- GDPR/ Data Protection gap analysis and maturity reviews
- Auditing
- GDPR framework implementation support
- Outsourced Data Protection Officer Services (DPO)
- Data Protection Impact Assessments (Review & Completion)
- Data Flow Mapping
- Supplier Assurance Frameworks
- Policy and procedure writing
- Training and awareness (online and face to face)
We hope you have enjoyed this months data protection news roundup. For more information on any of the above, please email us at info@istormsolutions.co.uk or call +44 (0) 1789 608708.
