What happened, who was affected, and what we can learn…
May served as a reminder: even data breach trends prompt warnings, and regulators expect action; not just disclosure.
ICO/OPC Joint Statement – 23andMe
Date Reported: 1st May, 2025
No. of UK Individuals Affected: ~155,000
Data Exposed or at Risk: Genetic and self-reported health data.
ICO Response: Joint warning with Canada’s OPC; instructed safeguards during bankruptcy process.
Summary: Regulators flagged risk in asset transfer scenarios and emphasised protection of DNA data held in trust.
Commentary: The issue is moving beyond fines; it’s about reputational control and cross-border accountability. Expect tighter scrutiny over corporate restructuring for any personal data controller.
ICO Reports on Cyber Hygiene
Date Reported: 10th May, 2025
No. of UK Individuals Affected: Not applicable.
Data Exposed or at Risk: N/A (advisory).
ICO Response: Released report emphasising phishing and brute‑force prevention measures.
Summary: Senior ICO leadership reiterated that foundational security controls are non-negotiable and that technical hygiene must be maintained.
Commentary: Regulatory tone is shifting; from reactive enforcement to proactive guidance. Organisations ignoring the basics are stepping into the spotlight.
Insights for UK Businesses
- Regulators are escalating beyond penalties; toward public trust and resilience.
- Basic cyber hygiene is now table stakes; not optional add‑ons.
- Data continuity during restructuring is vital; it can shape enforcement even prior to a final finding.
Legislative Context
With the Data (Use and Access) Act 2025 imminent, May’s guidance paved the way for mandatory baseline controls and enhanced cross‑border cooperation obligations.
Conclusion
May showed that regulatory messaging now comes early and loud. The ICO isn’t waiting for breaches before speaking out. If your governance gaps are visible in May, expect penalties later.
Disclaimer
This report is based on public disclosures, media reports, and ICO updates available at the time of writing. Figures for affected individuals may be estimated where not officially disclosed. This post is intended for informational purposes only and does not constitute legal advice.
