UK Legal Aid Agency says about 250,000 records stolen in its April 2025 breach predate 2007, the oldest from 1978. The bulk of the data still falls between January 2007 and 16 May 2025, three years earlier than the 2010 start the agency confirmed in May.
Perspective Coverage
4 publishers
- Builder
- Builder 5%
- Operator
- Operator 74%
- Investor
- Investor 21%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives45
- Confidence74
ICO reprimanded the Metropolitan Police for putting data on 179 people into Auror, a platform that had no data protection impact assessment. The force has tightened procedures since, but the regulator says it still is not ensuring that only approved tools are used.
Reality
- Evidence82
- Adoption60
- Hype gap−10
- Incentives
- Not scored
- Confidence78
UK Housing Ombudsman says a third-party security incident hit its case management system, and residents cannot file new complaints until systems return. The service calls the incident contained and is still establishing what data was involved.
Perspective Coverage
3 publishers
- Builder
- Builder 6%
- Operator
- Operator 67%
- Investor
- Investor 27%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence65
Ten AI developers including OpenAI, Google and Meta have changed or pledged to change their UK data protection policies after ICO pressure. Because the regulator says it is tracking delivery, buyers can now ask those vendors how they meet its training-data tests.
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives
- Not scored
- Confidence60
Robocall complaints at a five-year high draw an ICO investigation into suspected job scams
UK data regulator the ICO is investigating automated 'add me on WhatsApp' calls after logging more than 3,600 complaints in September, a five-year high. Because some of the recorded messages offer part-time work, job seekers look like the intended targets.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence55
Arena raised $200M at a $3.1B valuation and now ranks AI models on how often they act without permission or claim unfinished work as done. Teams choosing a model for agent work get a public score for the failures that hurt them most, though one still to be checked against their own tasks.
Perspective Coverage
6 publishers
- Builder
- Builder 28%
- Operator
- Operator 24%
- Investor
- Investor 48%
Reality
- Evidence60
- Adoption35
- Hype gap+30
- Incentives65
- Confidence58
Apparent hackers sent an extortion note through ASOS's app to UK customers, claiming to have "fully compromised" its Snowflake instance. ASOS has not confirmed a breach, so the only compromise anyone has seen is that outsiders could message its app users.
Perspective Coverage
15 publishers
- Builder
- Builder 21%
- Operator
- Operator 55%
- Investor
- Investor 24%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap−15
- Incentives66
- Confidence70
Domino's resets customer accounts that attackers opened with reused passwords
Domino's has reset a "very small number" of customer accounts that attackers opened with passwords leaked in breaches at other sites. The company says its own systems held, but a correct stolen password was all an attacker needed to get in.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+5
- Incentives55
- Confidence50
Ofqual found that 9% of teachers in England see senior leadership as primarily responsible for cyber security, while 46% name the IT team. The regulator says backups and response plans belong to leaders, a duty most staff assign elsewhere.
Reality
- Evidence62
- Adoption55
- Hype gap+8
- Incentives35
- Confidence66
Dyfed-Powys Police says a cyberattack identified on September 14 may have exposed staff data at a force of more than 2,000 officers and staff. Online and email contact is back in service while investigators establish whether the attackers reached any staff records.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence60
The CRM provider says its logs cannot identify which objects were accessed, and volume comparison suggests the whole database left. One AWS key became a sector-wide notification problem.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence65
ICO puts its processor guidance under review after the Data (Use and Access) Act
The page that sets out how UK processors must contract with controllers and authorise sub-processors now says it may change under the Data (Use and Access) Act. The duties on it apply meanwhile, and the revision timetable sits elsewhere.
Publishers:cy.ico.org.uk
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap0
- Incentives40
- Confidence72
Paris prosecutors open a criminal inquiry into women filmed by camera glasses
France's data regulator has fewer than 10 workplace complaints about smart glasses on file and says a recording light is not adequate notice on its own. Companies are already asking it whether they can ban the glasses at the door.
Reality
- Evidence52
- Adoption61
- Hype gap+18
- Incentives58
- Confidence47
The ICO wants one documented role decision for every processing step in your model chain
Its contracts and third parties section asks AI buyers to decide and record controller, processor or joint controller roles across the whole supply chain, and it warns that the guidance is under review after the Data (Use and Access) Act.
Publishers:ico.org.uk
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives32
- Confidence72
Swansea study puts 86% of licensed British gambling sites in breach of cookie consent rules
The ICO counts cookie compliance among the country's most visited websites, while Swansea researchers tested 624 licensed gambling sites against a different measure, and the enforcement record in that sector runs to a single reprimand.
Reality
- Evidence57
- Adoption68
- Hype gap+19
- Incentives62
- Confidence56
Ninety-two percent of UK account-hack loss reports arrived after Report Fraud went live
City of London Police recorded a 417% rise in account-hack losses to £6.3m in the year to March. The arithmetic underneath it shows the average loss per victim halving as small cases got recorded for the first time.
Reality
- Evidence62
- Adoption74
- Hype gap+14
- Incentives58
- Confidence66
Reform UK bets EU adequacy survives scrapping the ICO's multi-million-pound fines
The party would swap the UK GDPR for a New Zealand-style law that caps penalties at NZ$50,000, and its press release says Brussels would keep waving British data through without explaining why that holds.
Reality
- Evidence56
- Adoption14
- Hype gap+44
- Incentives74
- Confidence52
ICO guidance turns an unsubscribe into a row you have to keep
The UK regulator's direct-marketing guidance says the right answer to an opt-out is a suppression list rather than deletion, which means your erasure job and your campaign tooling have to agree on which identifiers survive.
Publishers:ico.org.uk
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence70
Local-government lawyers say AI-drafted complaint surge could require doubling staff
A one-sheet complaint about an unemptied bin now arrives as 19 to 27 pages of citations, and the UK association of local government lawyers reckons absorbing that would take double the staff it now assigns.
Reality
- Evidence28
- Adoption46
- Hype gap+24
- Incentives62
- Confidence34
buildOne report1 publisher The ICO fines what you cannot prove: Article 32 makes encryption and erasure an engineering liability
A dev.to guide reads the 2024-25 ICO record as a demonstrability test: over 12 million pounds in fines landed on breached organisations that could not show their controls. The arithmetic lands in the backlog.
Reality
- Evidence36
- Adoption
- Not scored
- Hype gap+31
- Incentives
- Not scored
- Confidence34