TRW & Co · Technology, Data & IP
Technology Lawyers in London
Technology lawyers London businesses instruct advise on the contracts, data, AI, cyber security and platform regulation behind digital products. UK law moved fast in 2025 and 2026: the Data (Use and Access) Act amended UK GDPR, Online Safety Act duties took effect and the CMA began regulating the largest platforms. Getting contracts and compliance right is now a board-level issue.
Key pointThe UK has no single technology or AI statute, so one digital product can be regulated at once by the ICO, Ofcom, the CMA and sector regulators. Mapping which regimes apply, and allocating that risk in contracts, is the first job.
At a glance
Data (Use and Access) Act
Royal Assent on 19 June 2025; it amends UK GDPR in stages, and a duty to handle data protection complaints took effect on 19 June 2026.
Online Safety Act fines
Ofcom can fine in-scope services up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, including providers based overseas.
Digital markets regime live
In October 2025 the CMA designated Google in general search and Apple and Google in mobile platforms with strategic market status.
UK GDPR penalties
Maximum UK GDPR fines are £17.5 million or 4% of worldwide annual turnover, whichever is higher, enforced by the ICO.
Contractor code ownership
Copyright in code written by an independent contractor stays with the contractor unless assigned in writing, a frequent due diligence problem.
Swipe or scroll →
What technology law covers in the UK
Technology lawyers London businesses instruct advise on the contracts, regulation, data and intellectual property that sit behind digital products and services. That includes software licensing and SaaS, cloud and outsourcing, artificial intelligence, data protection, cyber security, online platforms, digital markets competition, and the ownership and protection of code, content and data.
Technology law is no longer a niche for technology companies. A bank migrating to the cloud, a retailer using AI to price products, a manufacturer selling connected devices and a start-up launching an app all face the same core questions: who owns what, who is liable when something fails, what data may be used and how, and which regulator can intervene.
The UK framework changed significantly in 2025 and 2026. The Data (Use and Access) Act 2025 amended UK data protection law, the Online Safety Act 2023 duties took effect, the CMA began regulating the largest digital platforms, and the Cyber Security and Resilience Bill has been progressing through Parliament. EU rules, including the AI Act, reach UK businesses that sell into the EU.
This page sets out the legal landscape, the key contract and compliance decisions, and how to manage risk. For specialist detail see our data protection, artificial intelligence and IT and outsourcing pages.
The UK legal and regulatory framework
There is no single UK technology statute. Technology lawyers London clients rely on work across general contract and intellectual property law and a growing body of sector-specific digital regulation.
| Area | Main legislation | Regulator |
|---|---|---|
| Data protection and e-privacy | UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003, Data (Use and Access) Act 2025 | Information Commissioner's Office (ICO) |
| Online platforms and content | Online Safety Act 2023 | Ofcom |
| Digital markets competition | Digital Markets, Competition and Consumers Act 2024, Part 1 | Competition and Markets Authority (CMA) |
| Cyber security | Network and Information Systems Regulations 2018; Cyber Security and Resilience Bill (before Parliament) | Sector regulators, the ICO, with NCSC guidance |
| Connected products | Product Security and Telecommunications Infrastructure Act 2022 | Office for Product Safety and Standards |
| Intellectual property | Copyright, Designs and Patents Act 1988; Patents Act 1977; trade secrets rules | UK Intellectual Property Office and the courts |
Data protection after the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and has been brought into force in stages. It amends the UK GDPR rather than replacing it: it introduces recognised legitimate interests, relaxes some rules on automated decision-making subject to safeguards, adjusts the international transfer test, expands cookie exemptions and raises maximum PECR penalties to UK GDPR levels. A duty for controllers to have a process for handling data protection complaints came into force on 19 June 2026.
The Act also creates frameworks for smart data schemes and digital verification services. Fines under the UK GDPR can reach £17.5 million or 4% of worldwide annual turnover, whichever is higher. The Information Commissioner has been publishing updated guidance as each change takes effect. Our guide to the Data (Use and Access) Act explains the changes.
Online safety
The Online Safety Act 2023 imposes duties on user-to-user services and search services with links to the UK, regardless of where the provider is based. Illegal content and child safety duties are now in force, with age assurance required for services likely to be accessed by children that host certain harmful content. Ofcom can fine up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. See our guide to the Online Safety Act.
Digital markets
Part 1 of the Digital Markets, Competition and Consumers Act 2024 allows the CMA to designate firms with strategic market status in a digital activity and impose conduct requirements. In October 2025 the CMA designated Google in general search and Apple and Google in mobile platforms, and has since consulted on conduct requirements and accepted commitments. For app developers, advertisers and publishers, the regime creates new routes to complain and new rights in dealings with those platforms. Penalties can reach 10% of global turnover. Our article on strategic market status covers the detail.
Cyber security and connected products
The NIS Regulations 2018 apply to operators of essential services and certain digital service providers. The Cyber Security and Resilience Bill, introduced in November 2025, would extend that regime to managed service providers and data centres and tighten incident reporting. Separately, the product security regime under the Product Security and Telecommunications Infrastructure Act 2022 bans universal default passwords and requires vulnerability disclosure policies for consumer connectable products. The National Cyber Security Centre publishes the technical guidance most regulators expect organisations to follow. See our cyber security page.
Digital assets and electronic documents
Two recent statutes support digital commerce. The Electronic Trade Documents Act 2023 allows electronic versions of trade documents such as bills of lading and bills of exchange to have the same legal effect as paper, provided they meet the Act's reliability criteria. The Property (Digital Assets etc) Act 2025, enacted in late 2025, confirms that a thing can be personal property even if it is neither a thing in possession nor a thing in action, putting crypto-tokens and similar digital assets on a firmer footing. Technology lawyers London fintech and trade businesses consult now draft custody, security and insolvency terms with those Acts in mind.
UK technology regulation is now layered rather than unified. A single product can fall under data protection, online safety, consumer, product security and competition rules at once, each with its own regulator and its own penalties.
Artificial intelligence: law without an AI Act
The UK has no AI-specific statute. Instead, existing regulators apply their own powers to AI within their sectors, guided by cross-sector principles of safety, transparency, fairness, accountability and contestability. In practice, AI projects in the UK are governed by data protection law, equality law, consumer law, financial services rules, intellectual property law and contract.
Copyright is the most contested area. Training AI models on protected works can involve copying, and the UK's text and data mining exception is limited to non-commercial research. The government consulted on reform in December 2024 and published a report on copyright and AI in March 2026, as the Data (Use and Access) Act required, but has not yet legislated. Ownership of output is also uncertain: section 9(3) of the Copyright, Designs and Patents Act 1988 protects "computer-generated" works, but how that applies to modern generative AI is untested.
UK businesses that place AI systems on the EU market, or whose AI output is used in the EU, also need to consider the EU AI Act, which applies obligations according to risk category and has its own phased timetable. Our guides to AI regulation in the UK and AI contracts set out practical steps. Technology lawyers London companies consult on AI should focus first on data rights, transparency and contractual allocation of risk.
Key decisions in technology contracts
Most technology disputes trace back to contract terms agreed in a hurry. Technology lawyers London buyers and suppliers instruct usually focus negotiation on a small number of provisions that carry most of the risk.
- Scope and service levels. A clear specification, measurable service levels, service credits and the point at which persistent failure allows termination.
- Liability. Caps, exclusions and carve-outs, particularly for data breaches, IP infringement and confidentiality. Business-to-business exclusions must satisfy the reasonableness test in the Unfair Contract Terms Act 1977 where it applies.
- Data. Controller or processor status, Article 28 UK GDPR terms, security standards, breach notification timelines, international transfers and use of customer data to train models.
- Intellectual property. Ownership of bespoke developments, licences of background IP, open source compliance and rights in AI-generated output.
- Exit. Data return, transition assistance, escrow for critical software and continuity of service when a supplier fails.
- Regulatory flow-down. Outsourcing rules for regulated firms, operational resilience, audit rights and sub-contracting controls.
Consumer-facing terms raise different issues. Digital content supplied to consumers must meet the quality, fitness and description standards in Part 1, Chapter 3 of the Consumer Rights Act 2015, and subscription and pricing practices are now enforced directly by the CMA under the Digital Markets, Competition and Consumers Act 2024. Standard terms that would be acceptable between businesses may be unenforceable against consumers.
Check the liability cap against the realistic cost of a data breach or a prolonged outage, not against contract value. A cap set at twelve months' fees can be trivial compared with regulatory fines, customer claims and remediation costs. Our guide to SaaS agreements explains how to negotiate caps and carve-outs.
A technology project from procurement to exit
- Define the requirement. Document business needs, data flows, regulatory constraints and success criteria before talking to suppliers.
- Due diligence. Assess supplier security, financial strength, sub-processors, data locations, AI use and open source exposure.
- Data protection impact assessment. Required for high-risk processing, and good practice for any AI deployment or large-scale data migration.
- Negotiate the contract. Agree scope, service levels, liability, data, IP and exit terms, with regulatory flow-down where needed.
- Implementation and acceptance. Use clear milestones and acceptance tests; avoid deemed acceptance through use.
- Governance in life. Track service levels, change control, security reports and regulatory change, and keep the contract up to date.
- Exit or renewal. Start planning early, invoke transition assistance and secure data return and deletion certificates.
Documents and evidence to assemble
Investors, acquirers, regulators and courts all ask for the same core records. Technology lawyers London clients work with will want these kept current, because assembling them during a transaction or an incident is slow and expensive.
- Records of processing activities, data protection impact assessments, privacy notices and international transfer assessments.
- Information security policies, penetration test results, certifications and incident response plans.
- Master agreements, order forms, statements of work, service level reports and change notes for key suppliers.
- An inventory of software, including open source components and their licences.
- Invention and copyright assignment terms with employees and contractors, and records of who wrote key code.
- AI governance documents: model inventories, training data sources and licences, testing and human oversight records.
- Online safety risk assessments and records of moderation and age assurance measures, where the Online Safety Act applies.
Risks and common mistakes
Not owning the code you paid for
Under English law, copyright in software written by an independent contractor belongs to the contractor unless there is a written assignment. Many businesses discover during an investment round or sale that their core platform was built by freelancers or an overseas development agency without proper assignments. Fixing this later can be expensive and gives the developer leverage. Use written assignments in every development agreement and contractor contract, and audit IP chain of title before fundraising or a sale.
Using customer data to train AI without checking rights
Data collected for one purpose cannot automatically be reused to train or improve AI models. Contracts with business customers may prohibit it, and data protection law requires a lawful basis, transparency and compatibility with the original purpose. Confidential information and third-party content raise further issues. Before any training use, check contractual rights, update privacy notices, carry out a data protection impact assessment and consider anonymisation. Buyers should equally ask suppliers whether their data will be used to train shared models.
Slow or incomplete breach response
Controllers must report personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of them, unless the breach is unlikely to result in a risk to individuals. Sector regimes, contracts and overseas laws may impose shorter or additional deadlines. Delays often stem from unclear roles between controller and processor, or from waiting for a forensic report. Prepare an incident response plan, agree notification mechanics in supplier contracts and rehearse the process before a real incident.
Assuming UK-only rules apply
Technology businesses rarely operate in one jurisdiction. The EU GDPR, the EU AI Act, the Digital Services Act and national laws in key markets can apply to UK businesses that offer services to people abroad or monitor them. The Online Safety Act likewise applies to overseas services with UK links. Map where users, data and servers are located, and decide early whether to adopt the strictest standard across the group or manage regional variations deliberately.
Open source licence surprises
Most software includes open source components. Permissive licences are usually straightforward, but copyleft licences can require source code disclosure if the software is distributed or, for some licences, made available over a network. Undocumented open source use is a common issue in due diligence and can delay transactions. Maintain a software bill of materials, adopt an open source policy, and review licence obligations before distribution or acquisition.
Cross-border technology and data
International data transfers from the UK need a lawful mechanism: a UK adequacy regulation, the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or a limited exception. The UK extension to the EU-US Data Privacy Framework allows transfers to certified US organisations. Transfers into the UK from the EU depend on the EU's adequacy decisions for the UK.
Bangladesh is a significant software development and IT outsourcing destination for UK businesses. Transfers of personal data to Bangladesh require a transfer mechanism and risk assessment, and contracts should deal with IP assignment, security, local law and dispute resolution. Bangladesh has been reforming its own data protection and cyber security laws, so UK companies with operations there need current local advice. TRW & Co's Dhaka office works alongside the London team on these arrangements, and our UK-Bangladesh team covers wider cross-border issues.
Singapore (the Personal Data Protection Act 2012), China (the Personal Information Protection Law and data export rules) and the UAE (federal data protection law and separate regimes in the DIFC and ADGM free zones) each impose their own conditions on transfers and processing. Our Singapore, China and Dubai teams coordinate local advice.
How our technology lawyers London team helps
We advise technology suppliers, corporate customers, investors and start-ups. Our work is commercial and practical, with no outcome promises; where advocacy in the higher courts is required, we instruct specialist counsel.
Technology contracts
Drafting and negotiating SaaS, cloud, licensing, development, outsourcing and systems integration agreements, including liability, data and exit provisions that reflect real risk.
Data protection compliance
UK GDPR and Data (Use and Access) Act programmes, data protection impact assessments, international transfer assessments, and responses to ICO inquiries and subject access requests.
AI governance
AI use policies, procurement of AI tools, training data rights, EU AI Act scoping and contract terms for AI development and deployment.
Platform regulation
Online Safety Act scoping, risk assessments and age assurance, consumer law compliance for digital services, and engagement with the CMA's digital markets regime.
Cyber incidents
Incident response planning, breach notifications, supplier claims, insurance issues and regulatory engagement after a cyber attack or data breach.
Transactions and IP
Technology due diligence in M&A and venture capital, IP chain of title, open source audits and protection of software and trade secrets.
We work closely with our intellectual property and digital regulation teams.
Checklist for decision-makers
- Do we own, or have adequate licences to, the software, data and content our business depends on?
- Have we updated our data protection programme for the Data (Use and Access) Act, including complaints handling?
- Is there an AI inventory and policy, and do our contracts address training data and output rights?
- Do our liability caps reflect realistic breach and outage costs?
- Have we assessed whether the Online Safety Act, NIS rules or the product security regime apply?
- Are international data transfers documented with a valid mechanism?
- Do key supplier contracts provide workable exit and transition rights?
Technology lawyers London businesses involve early can make each of these decisions faster and with less risk. To discuss a contract, a compliance programme or an incident, contact our London office, or see all of our practice areas.
Frequently asked questions
01Does the UK have an AI Act?
No. The UK regulates AI through existing law and regulators rather than a single statute. Data protection, equality, consumer, financial services, product safety and intellectual property rules all apply to AI systems, and regulators such as the ICO, CMA and FCA apply their own powers. UK businesses selling AI systems into the EU, or whose AI output is used there, may also need to comply with the EU AI Act, which has a phased, risk-based timetable.
02What did the Data (Use and Access) Act 2025 change?
It amended UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. Changes include recognised legitimate interests, more flexibility on automated decision-making with safeguards, a revised test for international transfers, wider cookie exemptions, higher PECR penalties and a duty to handle data protection complaints, in force since 19 June 2026. It also creates frameworks for smart data schemes and digital verification services. Provisions have been commenced in stages.
03Does the Online Safety Act apply to my business?
It applies to services that let users share content with other users, such as forums, marketplaces with reviews, social features and messaging, and to search services, where they have links with the UK. That includes overseas providers with a significant number of UK users or that target the UK. In-scope services must assess risks of illegal content and, if likely to be accessed by children, child safety risks, and put proportionate measures in place.
04Who owns software developed by a contractor?
Under English law, the author of software is generally the first owner of copyright. For employees acting in the course of employment, that is the employer. For independent contractors and development agencies, it is the contractor unless there is a written assignment signed by them. Without one, the commissioning business may have only an implied licence. Use express assignments and confirm chain of title before investment or sale.
05How quickly must a data breach be reported?
Under UK GDPR, a controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals. High-risk breaches must also be communicated to affected individuals without undue delay. Processors must notify controllers without undue delay. Sector rules, contracts and overseas laws may add shorter deadlines.
06Can we transfer personal data to developers in Bangladesh?
Yes, with safeguards. Bangladesh does not have a UK adequacy regulation, so transfers typically rely on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment. The contract should also cover security, sub-processing, IP assignment, confidentiality and dispute resolution. Because Bangladesh's own data laws have been changing, take current local advice on obligations there.
07How should liability caps in SaaS contracts be set?
Start from realistic loss scenarios, such as a data breach, prolonged outage or IP infringement claim, rather than contract value alone. Customers often seek higher or separate caps for data protection and confidentiality breaches, and uncapped IP indemnities. Suppliers seek overall caps and exclusions of indirect loss. Exclusions must be clearly drafted and, where the Unfair Contract Terms Act 1977 applies, reasonable. Insurance cover on both sides should be checked against the agreed caps.
Sources and official materials
- Data (Use and Access) Act 2025 — Amendments to UK data protection law
- Information Commissioner's Office — UK GDPR and PECR guidance and enforcement
- Online Safety Act 2023 — Duties for user-to-user and search services
- Online Safety Act: explainer — Government summary of the regime
- Digital Markets, Competition and Consumers Act 2024 — Strategic market status regime in Part 1
- Cyber Security and Resilience Bill — Proposed reform of the NIS regime
- Product Security and Telecommunications Infrastructure Act 2022 — Security rules for connectable products
- National Cyber Security Centre — Cyber security guidance and incident support
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.