Privacy & Information Security Law Blog

On June 16, 2025, the UK Information Commissioner’s Office (the “ICO”) published its draft guidance on Internet of Things (“IOT”) products and services (the “Guidance”).  Through the Guidance, the ICO aims to provide clarity to manufacturers and developers of smart products, such as smart speakers and Wi-Fi fridges, to ensure they create products that comply with data protection law. The Guidance covers key areas such as:

• Types of Information: The Guidance explains the different types of personal data which may be processed by IoT products and services, including health, biometric and location data, and how such data may be used and collected.
• Accountability: The ICO considers areas of accountability in the context of IoT products and services, such as the controller and processor relationship, privacy by design, and the use of IoT products and services by children.
• Lawful Processing: The Guidance considers the application of the lawful bases and the special category conditions of processing under the UK General Data Protection Regulation (the “UK GDPR”) to of IoT products and services, and gives examples of how manufacturers and developers can seek to ensure that freely given, specific, informed and unambiguous consent is obtained by consumers.
• Fair Processing: The ICO encourages manufacturers and developers to consider how personal data is processed, focusing on key issues such as necessity, proportionality and purpose limitation.
• Transparency: The Guidance includes examples for manufacturers and developers on how to inform consumers of how they collect, use and share personal data.
• Security: The Guidance stresses the importance of implementing and maintaining appropriate technical and organizational measures, providing examples of such including encryption and multi-factor authentication.
• Data Subject Rights: The ICO reminds manufacturers and developers of their responsibility to inform consumers of their data subject rights under the UK GDPR.

The ICO’s intention behind the Guidance is to empower organizations to consider responsible use of information and compliance with data protection laws. However, the ICO has warned manufacturers and developers that it is “closely monitoring compliance” and will be “ready to act” where it believes “corners are being cut or personal information is being collected recklessly.”

The ICO has asked for manufacturers, developers and the wider tech industry to share their views on the draft Guidance, which will be open for consultation until September 7, 2025.