Risk Radar | December 2025

Data protection updates

ICO consultation on enforcement procedural guidance

Retailers may wish to contribute to the ICO's consultation on its new guidance about the process it follows when carrying out investigations and taking enforcement action, see here.

ICO launches guidance on disclosing documents securely

Many retailers need to regularly disclose or share documents containing large amounts of personal information. The new guidance sets out the most current and comprehensive resource on avoiding accidental data breaches when disclosing documents to the public.

The full guidance document can be located here.

Guidance on ransomware attacks on supply chains

The government has launched new guidance to assist organisations in spotting weaknesses in their supply chain and taking practical steps to safeguard against vulnerabilities, see here.

Financial services updates

CCR009: Preparing for the FCA’s new consumer credit reporting regime

Retailers with consumer credit FCA permissions need to prepare for the new CCR009 form. The FCA has introduced CCR009, a new consumer credit reporting regime marking a major shift toward more granular, outcomes-focused data collection. The form collects data from all consumer credit firms, including credit brokers. Firms must prepare for strict timelines, with the first reporting period covering 2025 and submissions due in late February 2026. This replaces several existing returns (CCR004 and CCR005) and partially replaces others, while firms must still submit some current reports (e.g. CCR007).

CCR009 requires detailed disclosures on permissions, business models, marketing, revenue, and staff, alongside specific data on broking activity, goods financed, motor finance, add-ons, and commission structures. Please let us know if we can help you prepare your first CCR009 data return.  Larger firms will report semi-annually, while smaller ones report annually. Retailers should use preparation for completing form CCR009 as a lens to reflect on their broader FCA compliance framework and whether the data collected shows areas that require additional focus.

Compliance updates

Protecting the mental health of employees this Christmas

On World Mental Health Day, the HSE urged employers to take practical steps to prevent work-related stress. Retailers should consider this guidance, particularly for retail staff working during the busy lead-up to Christmas, see here. 

Crime and Policing Bill update

The Bill has completed its Second Reading in the House of Lords. Retailers hope that the Bill will play an important role in protecting retail workers from physical/mental harm and addressing the soaring rates of shop theft. It is expected that the legislation will come into force in late 2025/ early 2026.

Consultation on Asbestos Regulations

Retailers whose property portfolios include older buildings may wish to contribute to the consultation on changes to the asbestos regulations. See the consultation here.

New ban on plastic wet wipes from Spring 2027

Retailers selling wet wipes containing plastic will need to phase out product sales by the time the ban is implemented in Spring 2027, see the press release here.

Marketing updates

The CMA launches a consumer protection drive on online pricing practices

The CMA has launched investigations into eight businesses – and written to around a hundred more – over pricing practices for online shoppers (including hiding mandatory fees, automatic opt-ins to other services, and misleading limited time sales counters), see our article here.

CMA cracks down on hidden fees for online shoppers

Retailers should familiarise themselves with the CMA's final guidance on unfair commercial practices relating to price transparency, see here.

HFSS volume price restrictions now in force

Retailers selling foods and drinks that are high in fat, sugar and salt (HFSS) will need to review their promotional activities following the government restrictions on volume price promotions, which came into force on 1 October 2025, see here.

ASA uses AI to review alcohol adverts

The ASA has completed a trial using AI to monitor alcohol advertising, in what is likely to be the first step in a broader rollout of AI usage by the ASA. See the ASA's article here.