Powered by Lexis+®
CASE STUDY

“It really is saving us a huge number of hours over the days, weeks and months. Having more relevant support at hand, not having to draft or review documents them from scratch - it all adds up.”

Southampton FC

Access all documents on Internet of things (IoT)

Internet of things (IoT) meaning

What does Internet of things (IoT) mean?
Internet of things (IoT) describes, in legal practice, networks of physical devices and sensors—ranging from everyday consumer products to industrial systems—that connect to the internet to collect, share and act on data, enabling remote monitoring, control and device-to-device interaction. The term is not generally defined in UK or Irish legislation or case law; it is a descriptive expression used across data protection, cybersecurity, product safety/product liability and commercial contracting. Typical issues for lawyers include: personal data processing (UK GDPR and DPA 2018; EU GDPR in Ireland); security-by-design and software update obligations; product safety and market-access rules for radio/connected equipment; allocation of risk, IP and cloud dependencies in supply and outsourcing contracts; and cyber incident reporting, evidence and disclosure. In the UK, consumer IoT is specifically addressed by the Product Security and Telecommunications Infrastructure Act 2022 and implementing regulations on consumer connectable products (including bans on default passwords, vulnerability disclosure and clear update policies). In Ireland/EU, IoT is governed by horizontal regimes including GDPR, the General Product Safety Regulation, the Radio Equipment Directive, the NIS framework (transitioning to NIS2) and the forthcoming Cyber Resilience Act. Usage is broadly consistent across England & Wales, Scotland, Northern Ireland and Ireland.
Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

View the related Checklists about Internet of things (IoT)

CHECKLISTS
EU Data Act (Regulation (EU) 2023/2854): Business Compliance Checklist—IoT Data Access/Portability, Smart Contracts, Unfair Terms, Switching Data Processing Services, Interoperability and Non-personal Data Transfers

This checklist outlines the key requirements of Regulation (EU) 2023/2854, the EU Data Act It sets out what businesses must adhere to, including the following areas: data access and portability smart contracts prohibition on unfair contractual terms right to switch services (operability) open interoperability rules on international data transfers The EU Data Act is designed to foster business-to-business (B2B) and business-to-consumers (B2C) data sharing from Internet of Things (IoT) devices, promoting fair use of data and enabling the EU to realise the full potential of its data economy. It represents the second major legislative step under the European strategy for data, following Regulation (EU) 2022/868, the EU Data Governance Act. Where the EU Data Governance Act establishes the mechanisms and structures that allow companies, individuals and the public sector to share data, the EU Data Act determines who may generate value from data and under which conditions. The EU Data Act entered into force on...

Read More Right Arrow

View the related Practice Notes about Internet of things (IoT)

PRACTICE NOTES
European Commission merger control: T-Mobile Netherlands/Tele2 Netherlands (M.8792) - unconditional Phase II clearance of Dutch 4-to-3 mobile telecoms merger (27 November 2018) [Archived case hub]

CASE HUB ARCHIVED this archived case hub captures the status as at the decision dated 27 November 2018; it is not being updated. See also timeline, commentary and related cases. Case facts Outline European Commission merger probe into the planned purchase by T-Mobile NL of Tele2 NL (Case M.8792). The deal involves horizontal overlaps within the Dutch mobile telecommunications market. Latest developments On 27 November 2018, the deal received unconditional clearance after an in-depth phase II review. Parties T-Mobile NL supplies telecommunication services to private and corporate customers in the Netherlands. It is a MNO with nationwide coverage delivering 2G, 3G, 4G and NarrowBand-Internet of Things (NB-IoT) mobile communications services. It also offers retail fixed services, including broadband Internet, TV and fixed telephony, based on wholesale access services. T-Mobile NL is a subsidiary of Deutsche Telekom. Tele2 NL is a Dutch telecommunications provider. It is a 4G-only MNO offering voice, data and messaging services, and also provides fixed broadband services in...

Read More Right Arrow
PRACTICE NOTES
UK TMT at IP completion day: TCA outcomes and legal impacts on data protection, e‑commerce, telecoms, media, intellectual property, cloud, IoT, domain names, advertising, databases, defamation and workforce

ARCHIVED: This archived Practice Note reviews the effect on the TMT sector following the end of the implementation period under the Withdrawal Agreement and the EU (Withdrawal Agreement) Act 2020. At 11 pm (GMT) on 31 December 2020—‘IP completion day’—the implementation period ended, which had enabled the UK to move away from the EU’s laws and institutions, and the UK’s legal regime altered immediately and substantially. It explains the implications across the following areas of TMT law and practice: Overview—what happened on 31 December 2020 TMT implications of the EU-UK Trade and Cooperation Agreement Access to EEA workers Technology contracts Drones Internet of things Software licensing Cloud computing E-commerce Domain names ePrivacy Data protection Media Telecoms Advertising Databases Defamation For a tracker of key TMT Brexit legislation and guidance, see Practice Note: TMT—Brexit tracker [Archived]. Overview—what happened on 31 December 2020 On 31 January 2020 (exit...

Read More Right Arrow
PRACTICE NOTES
UK Internet of Things compliance: data protection, ePrivacy and cyber security (UK GDPR, DPA 2018, PECR, PSTIA 2022) with DUAA 2025 updates

STOP PRESS: On 19 June 2025, the Data (Use and Access) Bill obtained Royal Assent, becoming the Data (Use and Access) Act 2025 (DUAA 2025), with elements taking effect that day. Measures addressing, among other things, responses to data subject access requests and the grant of powers to make further regulations commenced immediately on 19 June 2025. Other elements, including notices issued by the Information Commissioner and certain facets of law enforcement processing, began on 19 August 2025, two months after Royal Assent. The bulk of DUAA 2025 requires additional regulations, in the form of statutory instruments, before those provisions can start. Part 5 of DUAA 2025 revises aspects of the UK’s data protection and ePrivacy framework, covering the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426. Most of Part 5’s measures take effect on 5 February 2026 by virtue of the Data (Use and Access) Act 2025...

Read More Right Arrow