ICO publishes final guidance on consumer IoT products and services

Following a twelve-week consultation, the Information Commissioner's Office (ICO) has published its final guidance for consumer Internet of Things (IoT) products and services, setting out clear responsibilities for manufacturers and developers over the use of personal information. 

Under the guidance, privacy must be embedded by default, restricting data collection to what is strictly necessary. Consent must be explicit, specific, and as easy to withdraw as it is to grant. Genuine transparency requires plain-language information delivered at relevant points throughout product use, rather than just a static privacy notice. Due to the sensitive nature of IoT data, most businesses will need to conduct a data protection impact assessment (DPIA), particularly if children use the product or service. Security remains an ongoing legal obligation requiring regular updates, encryption, and multifactor authentication. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.