What end of support means for data protection, risk, and regulatory accountability

Windows 10 reached end of support on 14 October 2025. Any business still using it in 2026 is now operating unsupported systems while processing personal data. For many organisations, this places them directly at risk of GDPR non-compliance.

This is not a grey area. GDPR requires active, ongoing protection of personal data. Continuing to rely on an operating system that no longer receives security updates creates a known and avoidable risk.

What GDPR Requires From Businesses

Under Article 32 of UK GDPR, organisations must implement appropriate technical and organisational measures to protect personal data. In real terms, this means:

• Systems must be kept secure and supported
  
• Security vulnerabilities must be patched
  
• Risks must be reduced, not accepted by default
  
• Decisions must be defensible to regulators

An unsupported operating system fails this test. If security flaws cannot be fixed, the system cannot be considered appropriately protected.

Why Windows 10 Now Fails GDPR Expectations

Since Microsoft ended standard support in October 2025, Windows 10 no longer receives critical security updates. This has immediate consequences.

Permanent security vulnerabilities

Any new weakness discovered after the end-of-support date remains unpatched. Attackers actively scan for and exploit these systems because they know fixes will never arrive.

High regulatory risk after a breach

If personal data is compromised on an unsupported system, regulators are likely to view this as a failure to take reasonable precautions. This significantly increases the likelihood of enforcement action and higher fines.



Insurance and contractual exposure

Many cyber insurance policies, supplier agreements, and customer contracts require supported software. Continuing to use Windows 10 can invalidate cover or put your business in breach of contract.

At this point, choosing to remain on Windows 10 is a conscious decision to accept risk that GDPR expects businesses to address.

When, If Ever, Windows 10 Can Still Be Used

There are only a few scenarios where Windows 10 may still be acceptable in 2026. These are exceptions, not safe defaults.

A system may remain compliant only if:

Extended Security Updates (ESU) are in place

Microsoft’s paid ESU programme provides critical security patches through 2028. Without ESU, Windows 10 is unsupported.

The device is fully isolated

Air-gapped systems with no internet access, no network connectivity, and no personal data flow may reduce the risk, though this is rare in business environments.

A supported LTSC version is in use

Some Windows 10 Long-Term Servicing Channel editions have extended lifecycles, depending on the exact version deployed.

The Real Consequences of Doing Nothing

Businesses that continue to process personal data on unsupported Windows 10 systems expose themselves to:

• ICO investigations following incidents or complaints
• Financial penalties under UK GDPR
• Mandatory disclosure of data breaches to affected individuals
• Loss of customer trust and commercial credibility
• Issues with cyber insurance renewals and audits

Crucially, the longer Windows 10 remains in use, the harder it becomes to justify that risk.

What Businesses Must Do Now

To restore compliance and reduce exposure, action is required immediately:

• Upgrade to Windows 11 where hardware supports it
• Purchase ESU licences if upgrades cannot be completed in time
• Replace non-compliant hardware, particularly systems lacking TPM 2.0
• Audit all devices to identify unsupported operating systems

Delaying increases both security risk and regulatory exposure.

How CED Technology Can Help

CED Technology works with businesses across the UK to resolve compliance risks quickly and safely.

We can:

• Identify unsupported Windows 10 systems
• Advise on ESU, upgrade, or replacement options
• Plan and manage Windows 11 migrations
• Strengthen cyber security controls alongside the upgrade

If your business is still running Windows 10, action is required now.

Contact CED Technology today to secure your systems and bring your business back into GDPR compliance.