Data and cyber

Contact: Jon Bartley and Richard Breavington

Data and cyber

Action taken by ICO on cookie compliance for top sites

The Information Commissioner’s Office (ICO) has launched a 2025 strategy to improve cookie compliance across the UK’s top 1,000 websites, focusing on giving users meaningful control over their personal information. Following a review of the top 200 websites, the ICO raised concerns with 134 organisations and set clear expectations for compliance with data protection laws.

As part of the strategy, the ICO has published guidance on "consent or pay" models, which offer users a choice between personalised adverts or paid services. This guidance aims to balance user control with business needs. The ICO will also engage with consent management platforms and release public guidance this year to help users understand their rights regarding online tracking.

Find out more

Key cyber developments: looking back over 2024

For the cyber market, 2024 brought with it many legislative and regulatory changes, as well as sophisticated cyber-attacks and ground-breaking law enforcement activity. RPC have published a guide to recap the key developments from the past year in the cyber market.

Find out more

Government consultation on ransomware

On 14 January 2025, the UK Government issued a consultation aimed at reducing payment to cyber criminals in ransomware incidents and increasing the level of incident reporting.

The consultation contains three main proposals, and asks for views on various other options for potential legislative change. The three proposals are:

a targeted ban on ransomware payments for public services and critical national infrastructure
a wider "ransomware payment prevention regime" which would apply to all organisations
mandatory reporting of ransomware (possibly subject to specific thresholds).

Find out more

Data and cyber

Data dispatch – January 2025

Data Dispatch from RPC’s Data Advisory team aims to provide an easy-to-digest summary of key developments in data protection law. The latest edition explores a range of updates including:

navigating compliance in Italy: Garante’s stance on OpenAI’s Gedi partnership and GDPR violations
data protection in generative AI: Perspectives from the ICO and the EDPB
exploring the ICO's draft guidance on storage and access technologies.

Find out more