Beyond special category data: ICO signals new era of neurodata regulation
The Information Commissioner's Office (ICO) has published a report setting out findings from a citizens' jury commissioned to inform its developing guidance on how data protection law applies to neurotechnology (neurotech) and neurodata. Neurotech consists of devices that record or send electrical signals to the brain and nervous system. The UK neurotech sector is growing rapidly, with 54 dedicated companies generating nearly £120 million in turnover and attracting over £200 million in investment.
The ICO commissioned Nesta's Centre for Collective Intelligence to run the citizens' jury, bringing together 20 members of the UK public for three online sessions over two weeks in March 2026. Jurors engaged with specialist videos, heard presentations from sector experts and took part in facilitated deliberative discussions, working through the central question of how to make the most of the benefits of neurotechnology while managing the risks. The report's findings are qualitative and are not intended to represent wider UK public opinion.
Key findings
Support for beneficial uses, opposition to performance monitoring. Jurors were broadly supportive of medical, wellbeing and workplace-safety applications - such as devices that help manage pain or track driver fatigue. However, they strongly opposed using neurodata to monitor employee focus or student productivity, primarily due to concerns about discrimination. In particular, jurors doubted that highly individual brain data could be standardised fairly across diverse workforces or student populations, raising fears that defining a "normal" range of brain activity could penalise older workers, neurodiverse individuals, or those whose brain patterns simply differ from an assumed baseline. They were also concerned that the inherent power imbalance in workplace and educational settings would make it practically difficult for individuals to opt out in any meaningful sense.
Four priority regulatory measures. The jury identified four specific priorities, distinguishing between restrictions on collection from certain groups and restrictions on particular uses:
Restrictions on collection from vulnerable groups, including children, elderly people and individuals with mental illness or disability, who may be unable to provide genuinely informed consent and may not fully understand the longer-term implications of sharing their brain data.
Restrictions on use for targeted advertising and automated decision-making regarding access to services such as insurance - seen as a threat to individual autonomy and a form of commercial exploitation of highly sensitive personal information.
Stricter regulatory standards for read-write devices and any neurotech making clinical claims, including medical-grade testing requirements. Jurors were comfortable with read-only consumer wearables facing lower barriers to market entry but felt that devices capable of sending signals to the brain, or those marketed on the basis of clinical outcomes, warranted a materially higher level of scrutiny.
A new legal category for neurodata, which jurors viewed as fundamentally different from other personal data because it inherently captures subconscious thoughts and intentions that individuals cannot fully control, and because the current legal framework does not automatically afford brain data the same protections as other special category data.
High expectations for industry. Jurors expected neurotech companies to move away from passive opt-out models and complex terms and conditions, adopting instead clear opt-in consent frameworks and a privacy-by-design approach - including local data storage and data traceability. Technical accuracy was also emphasised as paramount, with participants noting that flawed neurodata could lead to serious consequences such as unfair dismissal. Jurors stopped short of calling for a blanket ban on neurotech, but called for a high bar for regulatory approval, favouring a model that restricts certain uses outright while applying case-by-case assessment to others.
Get in touch
Key takeaways for organisations
Regardless of whether your organisation operates directly in the neurotech sector, the report's findings and the ICO's forthcoming guidance may have broader implications. The following points are of particular relevance:
Review your consent mechanisms now. The jury was highly critical of opt-out models and lengthy, technical terms and conditions. If your organisation collects any form of sensitive neurological or biometric data, you should ensure your consent practices are clear, accessible and genuinely informed - and that they cover both primary and secondary uses of that data
Reassess secondary data uses. The use of neurodata for purposes beyond those for which it was originally collected - particularly advertising, profiling or automated decision-making - is likely to face intense regulatory scrutiny. Organisations should audit their data processing activities to identify and address any secondary uses that may be difficult to justify
Exercise particular caution in workplace and educational settings. The jury's strongest objections related to the monitoring of employee and student brain activity for productivity or focus. Organisations exploring such applications should carefully consider whether they can demonstrate a legitimate and proportionate basis for processing, and whether workers or students can genuinely opt out without adverse consequences
Prepare for a new neurodata regulatory category. The jury's call for neurodata to be treated as a distinct category of personal data signals a likely direction of regulatory travel. Organisations should begin considering how their data governance frameworks and privacy notices would need to adapt if neurodata is afforded a higher level of protection than current special category data rules provide
Adopt a privacy-by-design approach. Jurors were clear that trust in neurotech depends on companies embedding privacy protections into their products from the outset - not as an afterthought. Organisations should consider whether their product development processes adequately integrate data minimisation, local storage and traceability from the design stage
Watch for ICO guidance. The ICO has confirmed that formal guidance for the neurotech sector is forthcoming, following an industry engagement process and workshop on consent, harmful design and secondary data use. Organisations should monitor this guidance closely and use the current window to prepare for a more demanding regulatory environment
Our views
This report marks a significant step in the ICO's effort to ground its regulatory approach in genuine public engagement. The jury's call for a distinct legal category for neurodata reflects a growing view - both domestically and internationally - that existing special category data frameworks do not adequately capture the unique sensitivity of brain data. The involuntary nature of many neural signals, and the extent to which inferences can be drawn without conscious disclosure, challenges consent as an effective safeguard in isolation.
The ICO's next steps include engaging with industry, convening a workshop on consent, harmful design and secondary data use, and delivering formal guidance to provide greater regulatory certainty. Organisations should use this window to review their data governance frameworks and consent mechanisms ahead of what is likely to be a more demanding regulatory environment.
The content of this page is a summary of the law in force at the date of publication and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.
Related expertise
Contact us today
Whatever your legal needs, our wide ranging expertise is here to support you and your business, so let’s start your legal journey today and get you in touch with the right lawyer to get you started.
Get in touch
For general enquiries, please complete this form and we will direct your message to the most appropriate person.