General data protection
Guidance stages explained
Drafting – During this stage we pull together all relevant information and create a structured draft.
Public consultation/call for views (optional) – Usually we carry out a public consultation or call for views before we complete the guidance. To understand more about how and when we do this, you can read our consultation policy.
Redrafting (following consultation) – We make changes to the draft guidance to clarify issues and meet the needs of our audience.
Withdrawn – Occasionally we decide to not proceed with a guidance project. If so, we’ll mark it as withdrawn and remove it when we next update this page. If we decide to revisit an issue, we add a new entry to this page.
Published – Guidance is final and available on the website
List of guidance in development
- Article 9 and Substantial public interest tools
- Children’s Code FAQs for online TV broadcasting services update
- Contracts and liabilities between controllers and processors update
- Controllers and processors detailed guidance update
- Criminal offence data update
- Data sharing for scams and frauds
- Exemptions guidance update
- Handling subject access requests generated by AI
- Monitoring Workers
- Personal data breaches guidance update
- Privacy Notice Generator
- Public Task update
- The purpose limitation principle
- Recruitment and selection
- Research, Archiving and Statistics Provisions update
- Right of Access in brief update
- Right to Object
- Right to rectification
- Right to restrict processing
- SARs guidance for SMEs update
- SARs Q&A
- Special category data
Article 9 and Substantial public interest tools
New tools to support organisations in deciding about which special category data condition for processing may be appropriate.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Children’s Code FAQs for online TV broadcasting services update
ICO’s new position on online broadcasting in the scope of Information Society Services
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Contracts and liabilities between controllers and processors update
Stage: Drafting
Public consultation: Yes (due to launch August 2026)
Final version of guidance due for publication: Winter 2026
Controllers and processors detailed guidance update
Stage: Drafting
Public consultation: Yes (due to launch August 2026)
Final version of guidance due for publication: Autumn 2026
Criminal offence data update
Update of existing guidance to cover Data (Use and Access) Act changes
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Data sharing for scams and frauds
Update to advice to reflect new provisions in the DUA Act
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Exemptions guidance update
Update of existing guidance to cover Data (Use and Access) Act changes.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Handling subject access requests generated by AI
Stage: Drafting
Public consultation: Yes (due to launch August 2026)
Final version of guidance due for publication: Winter 2026
Monitoring Workers
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2026/2027
Personal data breaches guidance update
Update of existing guidance to cover Data (Use and Access) Act changes.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Privacy Notice Generator
Public Task update
Update of existing guidance to include amendments from the Data (Use and Access) Act
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Autumn 2026
The purpose limitation principle
To include update to existing guidance and additional guidance.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026
Recruitment and Selection
Research, Archiving and Statistics Provisions update
To include new amendments from the Data (Use and Access) Act.
Stage: Redrafting (following consultation)
Public consultation: Yes (closed)
Final version of guidance due for publication: Summer 2026
Right of Access in brief update
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Right to object
Right to rectification
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Spring 2026
Right to restrict processing
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Spring 2026
SARs guidance for SMEs update
Updates to four SAR products on advice for small organisations.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Spring 2026
SARs Q&A
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026
Special category data
Update of existing guidance to provide minor clarifications and reflect legislative change.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Summer 2026