Back Databreaches

UK Court of Appeal Rules on the Concept of Personal Data in the Context of Data Security

Databreaches •Dissent • February 27, 2026

Sam Jungyun Choi, Jadzia Pierce, and Paul Maynard of Covington and Burling write: On February 19, 2026, the UK Court of Appeal handed down its decision in DSG Retail Limited v The Information Commissioner [2026] EWCA Civ 140. The Court ruled that a controller’s data security duty applies to all personal data for which it acts as... Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UK Court of Appeal Ruling on DSG Retail's Data Security Responsibilities On February 19, 2026, the UK Court of Appeal ruled in the case of DSG Retail Limited v The Information Commissioner, clarifying that a data controller's security obligations extend to all personal data it manages. This decision comes in the context of a cyber attack on DSG's point-of-sale systems that occurred between 2017 and 2018, affecting the company's data security practices. 2 sources 26

Extracted Entities

Companies (3)

Covington And Burling DSG Retail Limited The Information Commissioner