The Data (Use and Access) Act 2025 (the DUAA) gained Royal Assent in June 2025. It includes a raft of reforms to the UK’s data protection and ePrivacy regimes that are relevant to almost all companies. While a small number of those reforms entered into force at earlier dates, the bulk of them became applicable on 5 February 2026.
This blog post explains some of the most significant new data protection and ePrivacy law changes that will impact those doing business in the UK. It also highlights certain other data protection reforms yet to be implemented.
The DUAA is a wide-ranging Act, with implications beyond data protection and ePrivacy law. Click here to read more about some of its other aspects.
Background
Prior to 5 February 2026, the UK’s data protection and ePrivacy regimes remained largely based on the EU’s GDPR and ePrivacy laws, except for some minor amendments that were required as a result of Brexit. The DUAA has now introduced notable further divergence from the EU’s regulatory regime.
The most consequential reforms now in force include:
| At-a-glance | Summary of the reforms |
| Facilitating international transfers of personal data | The DUAA introduces a more liberal ‘risk-based’ approach to international transfers of personal data that may therefore facilitate increased transfers of personal data outside the UK. This includes:
These reforms are explored further in our separate blog post. The DUAA also includes reforms to help facilitate responses by communications service providers (and various related entities) to certain information requests from US authorities. |
| Facilitating automated decision-making and use of AI | The reforms empower organisations to implement automated decision-making in additional scenarios. These complex but significant changes are explained in this blog post. |
| Changes to the ePrivacy regime governing aspects of direct marketing plus the use of cookies and other tracking tech | Key changes include:
|
| Protection of children’s data | The DUAA amends controllers’ data protection by design obligations for those processing personal data in the course of providing information society services (which include most online services) likely to be accessed by children. Under the reforms, in-scope controllers must take account of certain ‘higher protection matters’ when assessing what technical and organisational measures are appropriate. The Information Commissioner’s Office (ICO) has published updated guidance on data protection by design to help businesses apply this new duty. |
| Data subject requests | The DUAA implements changes to the calculation of timeframes within which responses to data subject requests must be provided and clarifies the scope of searches the controller is obliged to undertake. These changes will often benefit data controllers, including by specifying they may:
|
| New duties and powers for the ICO | The DUAA makes various changes to the ICO’s duties. For example, the ICO is now:
|
Other reforms that may be relevant to certain businesses and are now in force include:
| At-a-glance | Summary of the reforms |
| Facilitating the processing of personal data for new purposes | Reforms were made to:
Where relevant, businesses will need to ensure that compatibility assessments and templates are updated accordingly. |
| Assisting organisations using personal data in connection with undertaking certain research | The DUAA has:
|
| Minor amends to information/transparency obligations | These include creating a revised ‘disproportionate effort or impossibility’ exemption in relation to the requirement for information to be given to data subjects where the data was not collected directly from them. The reform is intended to clarify that the exemption applies to all processing and to provide a non-exhaustive definition. |
| Reformed notice period for personal data breaches impacting public electronic communications services | Providers of a public electronic communications service (ie entities which provide any service allowing members of the public to send electronic messages, including telecoms providers and internet service providers) are subject to a personal data breach notification regime under UK ePrivacy laws, which is distinct from that under the UK’s general data protection regime. Those obligations had previously included notifying the ICO of a personal data breach within 24 hours. The reforms (which took effect in 2025) have relaxed these obligations to require reporting of breaches without undue delay and, where feasible, not later than 72 hours after becoming aware of it (plus an obligation to explain any failure to notify within the 72 hours). |
Express confirmation that certain processing ‘may’ be lawful under the existing legitimate interests basis |
The reforms expressly confirm that certain processing may be permitted under this existing lawful basis if it passes a legitimate interests assessment, including processing necessary for: (1) direct marketing; (2) intra-group transmission of personal data for internal administrative purposes; and (3) ensuring the security of network and information systems. |
Reforms focused on the public and third sector | The DUAA also implements various other reforms that are generally most likely to be relevant to processing by public authorities, NGOs and charities (which are out of scope of this article). Those include a new ‘recognised legitimate interests’ lawful basis for certain processing related to: (1) national security, public security and defence; (2) serious civil emergencies; (3) detecting, investigating or preventing crime and apprehending or prosecuting offenders; and (4) safeguarding vulnerable individuals. |
Future reforms
While most of the data protection and ePrivacy related reforms are now in force, notable reforms yet to take effect include:
- New data controller duties relating to complaints: From 19 June 2026, the DUAA will give individuals a statutory right to make complaints to the controller and impose a statutory obligation on controllers to put in place processes to facilitate complaints and respond to them within certain timeframes. Privacy notices must be updated to reflect that right.
- The replacement of the ICO with a new ‘Information Commission’: The ICO currently regulates the UK’s data protection and ePrivacy regime along with many other information laws. The timeline for the ICO to be replaced by the Information Commission remains unclear. The government had previously indicated it was targeting ‘early 2026’ to complete this change.
More broadly, the DUAA introduces extensive powers for the Secretary of State to make subsequent reforms to UK data protection laws through secondary legislation and without the need to pass further primary laws through Parliament. For example, the Secretary of State is given powers to add new items to the list of special categories of personal data that benefit from additional protections under the UK GDPR. These powers make regulatory reform in various aspects of the data protection regime more likely going forward.
Implications
The DUAA introduces greater flexibility and divergence in certain areas (eg, automated decision-making, data processing in connection with research and international transfers). However, many organisations will be subject to both UK and EU GDPR regulations. As a result, the government’s efforts to reduce burdens on organisations might not lead to cost savings if organisations find it more cost-effective or otherwise prefer to adhere to the stricter EU GDPR standards to meet the requirements of both regimes.
The DUAA also introduces some new burdens on organisations and a need for them to consider how they should adapt their existing UK processes. For example, businesses will face potentially far higher fines for infringements of the ePrivacy regime, new enforcement powers and the requirement to put in place a process to facilitate data subject complaints.
Impact on transfers of personal data from the EU to the UK
The UK government has made clear that it understands the importance of keeping the UK’s designation from the European Commission as an ‘adequate’ jurisdiction, which allows most personal data to be transferred from the EU to the UK without the need to put in place additional safeguards. The European Commission did not regard the DUAA reforms as problematic, and the UK’s adequacy decision was renewed in late 2025. However, the further divergence from the EU’s regime may increase the odds of a successful challenge to the UK’s adequacy status before the EU’s Court of Justice, regardless of the European Commission’s view.
Action required
The reforms are evolutionary rather than revolutionary. Organisations that already complied with the UK data protection and ePrivacy regimes as they existed before 5 February 2026 are likely to only need to make limited changes to their governance or activities.
Nevertheless, it remains important to check that policies, processes and documentation have been reviewed and adjusted for compliance and to make the most of the new opportunities these reforms create.