An upcoming Data Protection Conference will focus on how regulators are tightening transparency and accountability around AI and automated decision‑making (ADM), with new guidance and codes of practice expected in the coming years.
Data protection and the regulatory timeline
Regulators are moving toward greater transparency over AI and ADM. The ICO’s final guidance on ADM is expected later this year, followed by a statutory Code of Practice on AI and ADM in 2028. At EU level, the AI Act’s transparency obligations take effect in August 2026, with requirements for high‑risk AI systems following in December 2027. Meanwhile, the UK Government’s Smart Data 2035 Strategy is reshaping data‑sharing obligations across the economy.
Practical issues the conference will address
The conference will examine what the new ADM guidance and Code of Practice will mean in practice, including data flow mapping, bias assessment, explainability, meaningful human oversight, third‑party accountability, and individuals’ rights to challenge automated decisions and seek redress. Organisers highlight that high‑risk AI processing will almost certainly require a Data Protection Impact Assessment (DPIA) before deployment and that the event will provide practical guidance on what an effective AI Impact Assessment should cover.
Sessions will cover updating privacy notices to explain use of AI and ADM, conducting due diligence on third‑party AI vendors, and meeting the ICO’s expectations for responsible use of ADM in recruitment, including what constitutes meaningful human involvement and how organisations should protect candidate rights.
Tracking technologies, children’s data and request handling
With a focus on digital advertising, the conference will explore the ICO’s expanded framework for storage and access technologies—extending beyond cookies to pixels, scripts, tags and fingerprinting—and what this means for consent, including potential changes to PECR consent requirements. It will also cover updated ICO guidance on children’s information and good practice for processing children’s personal data and applying privacy‑friendly age assurance.
As volumes of AI‑generated subject access requests (DSARs), freedom of information (FOI) requests and data protection complaints continue to rise, the programme will consider how organisations can manage responses at scale, where AI can support the process, and the circumstances in which requests may be refused.
Smart Data, agentic AI and governance challenges
Backed by £36 million of government investment, the Smart Data Strategy aims to establish five or more active Smart Data schemes by 2030 and at least 20 by 2035; the conference will examine what participation means for priority sectors and the new data protection obligations organisations should prepare for. Looking further ahead, sessions will consider emerging technologies and the advent of agentic AI, assessing how current AI standards and risk management frameworks apply, where gaps remain, and how organisations can prepare for the next generation of AI.
The event offers opportunities to hear directly from regulators and experts, network with peers, evaluate an organisation’s risks and governance arrangements, and learn practical steps to future‑proof approaches to data protection. Attendance options include in‑person or online.
