Meta AI suggestions asked Kalie Robins “Who’s the child passenger?” under a family video, then helped assemble her daughters’ names, ages and a likely home location. Meta says it “missed the mark” and has fixed the prompts. We dated the post, compared Meta’s statement with July’s Muse Image retreat, and found the fix changes the questions, not the answers.
Contributor pricing is Meta’s name for a simple trade: hand over your prompts and the model’s replies for training, and your bill drops by up to 21 times. TechCrunch’s Tim Fernholz reported the tier on 3 September 2026, a day after Meta shipped Muse Spark 1.3, and framed it in one line. Most AI tools […]
The general, all-sector answer to the question every UK business is now asking: how do you get the benefit of large language models without feeding them things you are paid to protect? This guide defines what private AI actually means, maps the five deployment levels from business-tier chatbots to fully self-hosted open-weight models, sets the UK GDPR and confidentiality position, prices a 20-person worked example across all four buyable routes, covers RAG without exposure, the NCSC and OWASP security layer, vendor due diligence in eight questions, and finishes with a 90-day rollout plan.
Hotel WiFi security is now a commercial problem rather than a facilities one. The wireless network that once existed so guests could check email has become the single largest attack surface most properties own: it carries guest devices you do not control, staff tablets that touch the property management system, card terminals in the bar, […]
Cyber security checklist templates written for a generic office do not survive contact with a lettings or block management business. The generic version assumes one building, one network, one set of laptops and a tidy boundary between staff and everyone else. A managing agent has none of that. It has branch offices, site laptops in […]
ChatGPT ad personalization is now written into OpenAI’s privacy policy, and that single sentence is the whole story. Advertising inside ChatGPT stopped being an experiment somebody at OpenAI was quietly testing and became a documented product behaviour with a legal basis, a data flow, a retention story and a settings screen. When a company writes […]
Section 80 of the Data (Use and Access) Act 2025 deleted Article 22 of the UK GDPR and replaced it with Articles 22A to 22D, commenced on 5 February 2026. The prohibition became a permission with conditions: for ordinary personal data you may now make solely automated significant decisions, provided you notify the individual, accept representations, provide genuine human intervention and allow a contest. This guide sets out the two-part test, what the ICO now means by meaningful human involvement, the special category data rules that did not relax, where automated decisions hide inside ordinary business software, the EU divergence that catches exporters, the evidence pack a regulator will ask for, seven failure patterns and a 60-day plan.
The Data (Use and Access) Act 2025 is fully commenced and there is no small-business exemption from the parts that matter. This checklist is written for the firm with no data protection officer and one person watching the shared inbox: a three-question scoping test, the five-item baseline every UK controller must meet, the conditional duties that only fire for some businesses, the new universal complaints procedure and its 30-day clock, the cookie audit behind a PECR ceiling that rose from £500,000 to £17.5 million, automated decisions hiding inside off-the-shelf SaaS, an honest hour-and-cost budget, the nine-artefact evidence pack, seven small-business failure patterns, and a ninety-day plan with owners.
The Data (Use and Access) Act 2025 edits UK data protection law rather than replacing it, which is why a summary is less useful than a diff. This guide sets the pre-2026 position beside the current one across lawful basis and the new Annex 1 recognised legitimate interests, the repeal of Article 22 and the safeguards in Articles 22A to 22D, the reasonable-and-proportionate subject access standard, the universal complaints duty and its 30-day clock, and the three narrow cookie exemptions behind a PECR ceiling that rose from £500,000 to £17.5 million. It then translates every change into the document you edit, the team that owns it, a 90-hour effort register, a UK-versus-EU divergence table, and a ninety-day plan.
The main data protection provisions commenced on 5 February 2026, the mandatory complaints procedure followed on 19 June 2026, and the maximum PECR penalty rose thirty-five-fold to £17.5 million. This guide sets out exactly what is in force, what is still pending, and what each change obliges a UK business to do differently: the commencement timetable tied to its statutory instruments, recognised legitimate interests and the direct-marketing trap underneath them, the repeal of Article 22 and the new Articles 22A to 22D on automated decision-making, the reasonable-and-proportionate subject access standard, the universal complaints duty and its 30-day acknowledgement clock, the three narrow cookie exemptions and why the analytics one is narrower than it looks, renewed EU adequacy to December 2031, what the Act pointedly did not change, and a sequenced six-step remediation plan for the rest of 2026.
