Powered by Lexis+®
Jurisdiction(s):
United Kingdom

UK and EU information law update: ICO fines LastPass; SAR guidance under Data (Use and Access) Act; GDPR enforcement procedures; Data Act helpdesk; CRA alignment consultation; VPA permitted disclosures

Published on: 18 December 2025

Published by a LexisNexis Information Law expert
Legal News
imgtext
Article summary

In this issue:

  • Data protection
  • Cybersecurity
  • Confidential information
  • Daily and weekly news alerts
  • New and updated content
  • Information Law Highlights 2025/2026

Data protection

ICO fines LastPass £1.2m for data breach affecting 1.6 million UK users

The Information Commissioner’s Office has imposed a £1.2m penalty on LastPass UK Ltd after a 2022 incident exposed personal data for as many as 1.6 million UK customers. The ICO concluded LastPass lacked adequate technical and organisational security, following two linked intrusions in August 2022 that let attackers obtain names, email addresses, telephone numbers and saved website URLs. The compromise began with a breached corporate laptop, before a senior staff member’s personal device was targeted to extract decryption keys for a backup database. See: LNB News 12/12/2025 16.

ICO updates SAR guidance and publishes template following Data (Use and Access) Act 2025

Following the Data (Use and Access) Act 2025, the ICO has refreshed its core Subject Access Request guidance and released a new subject access request template aimed at small businesses. Entitled ‘Ask for copies of your data,’ the template is intended to help small firms interpret and organise requests from individuals seeking copies of their personal information...

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Popular documents

When evaluating a general damages claim, the practitioner ought initially to refer to the Judicial College Guidelines (JCG)...

Read More Right Arrow

This Practice Note This Practice Note reviews mechanisms used in settling litigation. A Tomlin order consists of a consent order paired with a schedule. It operates to stay proceedings on terms that have been agreed. The provisions contained in the schedule may remain confidential. This Practice Note describes the scope of confidentiality attaching to the schedule and sets out how it differs from a standard consent order. Sample wording for a Tomlin order is included, alongside links to precedents, as well as guidance on court approval. It also addresses varying, setting aside and enforcing a Tomlin order, including the considerations the court will take into account when handling applications for each. Further guidance is provided on interpreting and applying the relevant provisions of the CPR; however, some courts and divisions impose very specific requirements for both drafting and approval, and for approaching the schedule and confidentiality issues. Accordingly, you must consider the particular rules and court guide provisions in the forum where your claim is proceeding when drawing up the Tomlin order...

Read More Right Arrow

Date [ date ] Parties [ name of Landlord ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Landlord) [ name of Tenant ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Tenant) [ [ name of Guarantor ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Guarantor) ] [ [ name of Mortgagee ] [ of OR incorporated in England and Wales (company registration number [ number ]) with its registered office at ] [ address ] (Mortgagee) ] Definitions Within this Deed, the terms below shall be interpreted as follows: [ Annual Rent • the annual sum reserved under the Lease; ] [ Insurance Rent • the Tenant’s share of the Landlord’s costs of insuring the Property (as set out in the Lease); ] Lease • the lease of the Property dated [ date ], entered into between (1) [ the Landlord OR [ name ...

Read More Right Arrow

I, [ name ], of [ address ], solemnly and sincerely state that: [ Matters to be verified, set out in numbered paragraphs ] I make this solemn statement in good conscience, believing it to be true, and pursuant to the provisions of the Statutory Declarations Act 1835. DECLARED at [ details ] this [ day ] day of [ month and year ] Before me ................................................................................ [ signature of the person before whom the declaration is made ] A [ commissioner for oaths OR [ solicitor OR [ insert other qualification ] ] authorised to administer oaths ]...

Read More Right Arrow