As neurotechnology advances from the laboratory into the consumer marketplace, the Information Commissioner's Office (ICO) has taken a significant step towards understanding public expectations around the collection and processing of neurodata.

In March 2026, the ICO commissioned Nesta's Centre for Collective Intelligence to convene a Citizens' Jury of 20 members of the UK public, tasked with deliberating on a deceptively simple question: How do we make the most of the benefits of neurotechnology while managing the risks? While the numbers involved were few, the resulting report published on 22 July 2026 offers valuable insight for privacy professionals navigating what is rapidly becoming one of the most complex frontiers in data governance. 

Why neurodata demands attention now

The UK neurotechnology sector is growing at pace. There are currently 54 dedicated neurotech companies that generate approximately £120 million in turnover, attract over £200 million in investment and have annual growth of 14.1%. As these technologies extend beyond healthcare into consumer-facing applications across wellbeing, workplace productivity and education, the data protection implications are significant. 

This tech uses information taken directly from the brain to predict, diagnose and treat complex physical and mental illnesses, as well as to understand emotions, preferences and cognition. Successful use cases range from the more familiar cochlear implants for hearing restoration to deep brain stimulation for movement disorders and brain-computer interfaces (BCI) for paralysis, using thought-to-control prosthetic limbs or wheelchairs, or achieving near-natural conversational speed by decoding speech brain signals into sentences in real time. 

Neurodata, i.e. the raw electrical signals recorded from an individual's brain and the inferences derived from them, is among "the most sensitive and uniquely personal information that can be collected". Its involuntary nature and the limited control individuals have over the data created or the inferences that can be drawn from it, "challenge the notion of consent as a cornerstone of data protection". The ICO has acknowledged that innovators in this space are navigating considerable uncertainty when applying data protection law and is developing guidance accordingly. 

Key findings: public expectations and regulatory signals

1. The classification question

A central theme of the Jury's deliberations was the legal classification of neurodata. Jurors were surprised that brain data does not automatically receive the same protections as special category data under the UK GDPR. There was "strong consensus that neurodata is fundamentally different from other forms of personal data, as it inherently captures subconscious thoughts and intentions that individuals cannot fully control". Jurors also supported the creation of a distinct new legal category for neurodata, arguing that without clear legal definitions, "regulators cannot effectively protect users" and commercial actors could exploit loopholes. 

Under the Data (Use and Access) Act 2025, the Secretary of State now has power to add new types of processing or data types to the special category data list. Whether this is the right option for neurodata remains to be seen but it could be an agile solution to give some heightened protection while this emerging tech enters the mainstream.

2. Consent and meaningful control

The Jury was critical of traditional consent mechanisms, finding standard terms and conditions too complex or jargon-laden to capture genuinely informed consent. Freedom of choice and control were identified as the top two priorities for developing trustworthy neurotechnology. Jurors advocated strongly for opt-in models over opt-out frameworks, with accessible, digestible explanations of both primary and secondary uses of neurodata. One juror even suggested retroactive consent options, allowing users to "retain an even greater degree of control over their neurodata".

3. Purpose limitation and secondary uses

The Jury drew a sharp line around secondary uses of neurodata. There was strong opposition to "neuromarketing", i.e. the use of neurodata to make inferences about preferences, emotion or mood for targeted advertising or behavioural nudging. This is in line with the EU's position under the Digital Services Act where online platforms cannot profile users using special categories of personal data, e.g. sexual orientation, religion or race, for the purposes of presenting online advertising. Also, if AI were to be used in conjunction with neurodata, compliance teams would need to assess whether any of the proposed uses were categorised as "prohibited" - and therefore could not proceed - or "high-risk" – requiring compliance with the obligations set out in the EU AI Act.

Jurors also expressed particular concern about neurodata being used in automated decision-making (ADM) regarding access to services. One juror proposed enhanced traceability mechanisms, such as watermarking, to verify that neurodata is not repurposed for unauthorised secondary uses. ADM and transparency are also in the regulatory spotlight so seeing them emerge in this conversation is not surprising and, for those working with neurodata, further thought will be needed in order to ensure compliance.

4. Vulnerable groups and power imbalances

The report highlights serious concerns around power imbalances in contexts where individuals may lack genuine agency to refuse neurodata collection. Many jurors wanted restrictions on collecting neurodata from children, vulnerable people and individuals with mental illness, on the basis that these groups may be unable to provide genuinely informed consent. There was also consideration of whether certain restrictions should be placed on collection of neurodata for specific purposes, i.e. an "unacceptable" or "prohibited" category, much like that in the EU AI Act, where the risk outweighs any perceived benefits.

Workplace and educational settings attracted particular scrutiny, with jurors worried that employer-employee and teacher-student dynamics could make it effectively impossible for individuals to withdraw consent. Neurodata used in such settings would be considered "high-risk", again aligning with the EU AI Act, and warranting additional safeguards. This is not a new problem but one that needs careful consideration given the sensitivity of the data being collected and the far-reaching consequences its usage may have.

Emerging risks and compliance challenges

1. Data minimisation and accuracy

The involuntary and continuous nature of brain signal capture poses novel challenges for data minimisation principles. Neural signals are generated continuously by autonomic and cognitive processes regardless of whether the individual intends to communicate anything. Given most neurotech devices are "always-on" (harking back to their initial use in the medical context) an uninterrupted stream of highly granular biological information is collected, rather than discrete, purpose-bound data points, making it structurally difficult to isolate only the data "necessary" for a stated purpose at the point of collection.  

Jurors also raised concerns about the accuracy of algorithms used to interpret neurodata, noting that flawed data could result in dangerous misdiagnoses in well-being contexts or unfair dismissals or discrimination in a workplace context. Bias detection is an area that was debated during the passage of the EU AI Act with assurance mechanisms such as bias audits and performance testing necessary to mitigate these risks. It is likely given the prevalence of algorithms in the neurotech sector that similar safeguards will need to be put in place.

The Jury also highlighted that if neurotech devices are not trained on diverse populations, they risk producing discriminatory outcomes for neurodivergent individuals or those with different physiological baselines. In order to comply with equality legislation, DEI guidance, and best practice anyone working in this sector should be addressing these issues in their compliance frameworks.

On the flip side, if used in a responsible way, neurodata could help unlock understanding in how neurodivergent individuals live, learn and work and therefore bring real benefits and tailored adjustments never previously considered. 

2. Privacy by design

The Jury placed significant emphasis on privacy by design, viewing strict technical design requirements, such as local on-device data storage, encryption and data traceability, as more realistic protective measures than relying on individual users to navigate complex consent frameworks. Jurors also supported anonymisation of neurodata upon collection, although some acknowledged the tension between anonymisation and the utility of data for medical research. Both the ICO's and the EDPB's recent anonymisation guidance, as well as their privacy by design guidance (ICO and EDPB), will be helpful for those grappling with these issues. 

3. Regulatory co-ordination

Jurors recognised that neurotechnology is a global industry, with manufacturing and data processing frequently occurring outside the UK. France, Chile and several US states (e.g. California, Colorado, Connecticut and Montana) already have legislation governing aspects of neurodata and Latin America has several legislative proposals on the table, most notably in Brazil, Mexico and Argentina. Care will need to be taken when completing transfer risk assessments for any transfer of neurodata where, e.g., there is no data bridge in place with the UK, or for those in the EU, an adequacy decision. 

The Jury identified the risk of developers exploiting inconsistencies between jurisdictions or regulatory bodies and so supported the ICO collaborating with other UK and international regulators to ensure uniform standards and mitigation of risk. The Medicines and Healthcare products Regulatory Agency (MHRA) and the Law Society of England and Wales have also been thinking about this technology, how it is developing and how best to regulate it. 

Practical takeaways

For those working in or considering the neurotech sector there are some practical steps you can take now to help with your compliance. 

• Assess your organisation's neurodata exposure. If your organisation collects or processes neurodata, or procures neurotechnology services, conduct a data mapping exercise to identify any neurodata processing activities and evaluate whether existing DPIAs adequately address the unique sensitivity of brain data.
• Consider setting up an ethics committee or obtaining ethics advice to assist with your governance. As with any emerging tech, the reputational issues of getting this wrong are high stake, more so than any monetary penalty that might follow. Given the involuntary and continuous nature of neurotech and the novel challenges it presents, ethics advice would go a long way to demonstrating your commitment to getting this right.
• Assess your project against existing recommendations, guidance and best practice from reputable organisations. The OECD's Recommendations of Responsible Innovation in Neurotechnology and their Neurotechnology toolkit, the ICO's tech futures report on neurotech, ISO standards (ISO/IEC JTC 1/SCX 43 and ISO/IEC TS 27571:2026) and the Regulatory Horizons Council's Neurotechnology Regulation report are some examples of existing support available in this sector.
• Treat neurodata as warranting special category-level protections. Pending formal ICO guidance, at the very minimum it would be prudent to adopt a precautionary approach by applying safeguards equivalent to those required for special category data under Article 9 of the UK GDPR, especially in light of the strong public expectation and regulatory direction of travel.
• Re-examine your consent mechanisms. Move away from passive opt-out models and dense legalistic terms towards clear, accessible, opt-in frameworks that allow granular user control over both primary and secondary uses of neurodata.
• Embed privacy by design from the outset. Prioritise on-device processing, encryption, anonymisation and data traceability in the design phase of any neurotech product or service.
• Restrict secondary use and enforce purpose limitation rigorously. Establish clear internal policies prohibiting the secondary use of neurodata, and in particular restrict its use for marketing, behavioural nudging or automated decision-making in relation to access to services. Where secondary use is envisaged, be transparent and ensure you have a robust lawful basis and can evidence explicit, informed consent is in place.
• Your DPIA is key. As with any emerging tech, your DPIA will need to be detailed and specific to your project. You must also keep it under review and update it as required as your project progresses. A general, high-level DPIA will not cut it if the regulator comes knocking.
• Implement heightened technical and organisational security measures proportionate to the sensitivity of neurodata. Neural signatures cannot be reset like a compromised password! Organisations should apply Article 32-aligned controls that go beyond baseline requirements, e.g. strict access-controls, MFA, encryption, rigorous due diligence for third-party processors and vendors, a well-rehearsed incident response plan. Given the irreversible nature of neurodata compromise, organisations should ensure their breach response plans account for the notification obligations under Articles 33 and 34 of the UK GDPR and consider the unique harm profile of hacked neural data.
• Monitor the ICO's forthcoming formal guidance. The ICO has confirmed it will deliver formal guidance offering greater regulatory certainty for organisations developing brain-data-centred services. Ensure your compliance teams are tracking this closely and preparing to operationalise its requirements.

If you have any questions or would like to discuss neurotechnology or neurodata in more detail, please do reach out to your usual Lewis Silkin contact.