Mariya Peykova explores what data controllers can learn from recent Court of Appeal case
16th March 2026

3PB’s specialist commercial, public and information law barrister, Mariya Peykova, has written a case summary of the judgment in 'DSG Retail Limited v Information Commissioner [2026] EWCA Civ 140' handed down in February this year.
She discusses the scope of the duty imposed on data controllers to protect personal data in their possession and control by taking appropriate technical and organisational measures ('ATOMs') and how the security duty is particularly relevant when data controllers fall victim to cybersecurity attacks that result in hackers exfiltrating personal data.
Mariya explains the Court of Appeal’s judgment, which held that the security duty requires a data controller to take ATOMs against the risk of processing by a third party of data which relates to an individual who is identifiable to the controller, even if the personal data does not enable the third party to identify the data subject in question.
To read Mariya’s full article please click here.
To contact or instruct Mariya, please email David Fielder on [email protected] or telephone 020 7583 8055.