Regulatory Frameworks

The regulatory landscape is tightening globally. Organisations must comply with frameworks such as GDPR, NIS2, the EU AI Act, ISO 42001, and emerging sector-specific guidance for financial services and healthcare. For example, the FCA Consumer Duty requires financial institutions to evidence strong operational resilience, responsible data use and robust oversight of suppliers. Similarly, NHS-linked bodies must use the Data Security and Protection Toolkit (DSPT), which requires clear identity access controls, privileged-account governance and breach-response readiness.

Data Privacy

Enforcement is intensifying. The message from the ICO in October 2025 was clear: “Maintaining good cybersecurity is fundamental to economic growth and security. With so many cyber attacks in the headlines, our message is clear: every organisation, no matter how large, must take proactive steps to keep people’s data secure. Cyber criminals don’t wait, so businesses can’t afford to wait either”. In 2025, Capita were issued a fine of £14m for failing to ensure the security of personal data related to a breach and Guernsey’s Office of the Data Protection Authority (ODPA) fined a medical group £100,000 after patient data was stolen due to poor patching and delayed threat detection.

AI Governance

The release of ISO 42001 and growing AI regulatory frameworks highlight the need for organisations to monitor AI usage, enforce data access controls, and maintain auditability of AI-driven processes. Organisations that fail to establish clear AI governance risk not only operational disruption but also regulatory penalties.