Data Use and Access Act 2025 Key Changes for Organisations
The Data (Use and Access) Act 2025 represents the most significant reform to UK data protection law since Brexit, amending the UK GDPR, Data Protection Act 2018, and Privacy and Electronic Communications Regulations without replacing these foundational frameworks. The Act aims to simplify compliance burdens for organisations while maintaining high data protection standards and preserving the UK's European adequacy status, enabling continued personal data flows with EU member states essential for international business operations.
Key changes affecting organisations include the introduction of "recognised legitimate interests" providing clearer lawful processing grounds for crime prevention, safeguarding, and emergency response scenarios without requiring individual balancing tests. Scientific research provisions clarify that commercial research qualifies under research exemptions, with organisations permitted to seek "broad consent" for related research areas where specific purposes cannot be fully identified at collection. These research flexibilities prove particularly valuable for organisations developing AI systems and conducting commercial product development requiring personal data processing.
UK Data Protection 2026 Legislative Framework Summary
| DUAA 2025 Change |
Previous Position |
New Position |
Business Impact |
| PECR Maximum Penalties |
£500,000 maximum fine |
£17.5m or 4% turnover |
Critical marketing compliance review required |
| Analytics Cookies |
Consent required |
No consent if conditions met |
Cookie banner simplification possible |
| DSAR Search Obligations |
Comprehensive searches expected |
"Reasonable and proportionate" codified |
Reduced compliance burden for complex requests |
| Complaint Handling |
No specific requirement |
Mandatory complaints procedure |
New internal process implementation needed |
| Automated Decision-Making |
Restricted to contract, law, explicit consent |
Permitted on broader lawful bases |
AI deployment flexibility increased |
The automated decision-making provisions represent significant relaxation, permitting solely automated decisions affecting individuals on broader lawful bases beyond the previous restrictions to contractual necessity, legal requirement, or explicit consent. Organisations may now deploy automated systems including AI-based decisions on legitimate interests grounds for non-sensitive personal data, provided appropriate safeguards exist including information provision, contestation rights, and human intervention availability upon request, enabling greater operational efficiency in customer service, credit decisions, and recruitment processes within ICO data protection principles frameworks.
ICO Enforcement Trends and Penalties 2025
The Information Commissioner's Office enforcement activity during 2025 demonstrates continued regulatory vigilance, with significant penalties issued against organisations failing to implement adequate security measures and data protection frameworks. Between 2019 and September 2025, the ICO imposed 119 monetary penalty notices under PECR totalling approximately £10.5 million, alongside 16 UK GDPR fines totalling approximately £65 million excluding the overturned Clearview AI penalty, reflecting sustained enforcement commitment across both regulatory frameworks.
The October 2025 penalty against Capita stands as one of the most substantial ICO fines for cyber-related breaches, with Capita plc receiving £8 million as data controller and Capita Pension Solutions Limited receiving £6 million as data processor for failures enabling the March 2023 cyber attack compromising personal data of 6.6 million individuals. The breach exposed sensitive information including home addresses, passport images, financial details, and criminal records circulating on the dark web, with the ICO determining that inadequate security measures and delayed incident response constituted serious UK GDPR Article 5(1)(f) and Article 32 violations requiring substantial financial penalty following government data protection guidance principles.
Major UK GDPR and PECR Enforcement Actions 2019-2025
- Capita (October 2025) - £14 million: Inadequate cybersecurity measures enabling ransomware attack affecting 6.6 million data subjects across 325 pension schemes
- TikTok (2023) - £12.7 million: Processing children's personal data without appropriate parental consent and transparency failures
- British Airways (2020) - £20 million: Personal data breach affecting approximately 400,000 customers due to inadequate security measures
- Marriott International (2020) - £18.4 million: Data breach exposing personal information of approximately 339 million guest records globally
- Interserve (2022) - £4.4 million: Ransomware attack enabled by phishing email affecting personal data of up to 113,000 employees
- Advanced Computer Software (2025) - £3.07 million: Ransomware attack disrupting NHS services due to inadequate cybersecurity measures
ICO enforcement priorities for 2025-2026 continue focusing on children's privacy, online advertising practices, and cookie consent compliance. The national cookies compliance check expanded to include the UK's top 1,000 websites during January 2025, with the ICO expressing concern that many organisations fail to follow guidance on website design and fail to provide users adequate choice regarding tracking for personalised marketing. The ICO's September 2025 consultation on online advertising reform signals potential further secondary legislation creating additional cookie consent exceptions for low-risk advertising activities, though organisations should maintain cautious compliance approaches until regulatory clarity emerges.
PECR Cookie Consent and Marketing Compliance 2025
The Privacy and Electronic Communications Regulations 2003 amendments under the Data Use and Access Act 2025 fundamentally transform the UK data protection 2026 compliance landscape by aligning maximum penalties with UK GDPR sanctions. Previously, PECR violations including cookie consent failures and direct marketing breaches faced maximum fines of £500,000, creating disproportionate risk exposure compared to UK GDPR security breaches. Following DUAA implementation, PECR violations now attract potential penalties of £17.5 million or 4% of annual worldwide turnover, whichever is higher, making marketing compliance as financially significant as data security compliance.
New cookie consent exceptions under Schedule A1 PECR permit storage and access technologies without explicit consent in specific low-risk circumstances. Cookies collecting information for statistical purposes about service usage with improvement aims no longer require opt-in consent, provided users receive transparency about purposes and have objection mechanisms available. Similarly, cookies enabling appearance or functionality adaptation to user device preferences qualify for exemption, potentially simplifying cookie banners for organisations deploying only essential and analytics functionality without cross-site tracking or advertising purposes.
Cookie Consent Requirements Following DUAA 2025
| Cookie Category |
Consent Required? |
Conditions for Exemption |
Practical Implementation |
| Strictly Necessary |
No (unchanged) |
Essential for service delivery |
Session management, security, load balancing |
| First-Party Analytics |
No (NEW exemption) |
Statistical purposes + improvement aim + opt-out available |
Website performance measurement without cross-site tracking |
| Functionality/Preference |
No (NEW exemption) |
Appearance/functionality adaptation + transparency |
Language preferences, display settings, accessibility |
| Advertising/Marketing |
Yes (consent required) |
No exemption - explicit opt-in required |
Targeted advertising, cross-site tracking, profiling |
| Third-Party Tracking |
Yes (consent required) |
No exemption - explicit opt-in required |
Social media pixels, third-party analytics, remarketing |
Direct marketing compliance under PECR continues requiring careful attention following penalty alignment. The ICO has maintained active enforcement against unsolicited marketing communications, with telemarketing companies receiving substantial fines for calls to individuals registered with the Telephone Preference Service. DUAA 2025 introduces "soft opt-in" provisions for charities, permitting electronic mail marketing to individuals whose personal information was collected when they supported, or expressed interest in, charitable purposes, unless they object. This mirrors the existing soft opt-in available to commercial organisations marketing similar products to existing customers, expanding compliant direct marketing opportunities for the charitable sector.
Data Breach Notification and Cyber Security Requirements
The Cyber Security Breaches Survey 2025 reveals the persistent threat landscape facing UK organisations, with 43% of businesses and 30% of charities experiencing cyber security breaches or attacks during the past twelve months. This represents approximately 612,000 UK businesses and 61,000 charities identifying breaches requiring assessment against notification obligations, incident response procedures, and potential regulatory reporting depending on risk levels to affected individuals.
Medium and large businesses face particularly elevated exposure, with 67% of medium businesses and 74% of large businesses reporting breaches or attacks. Phishing attacks dominate the threat landscape, affecting 85% of businesses and 86% of charities experiencing any breach, while ransomware incidents have doubled from less than 0.5% to 1% of businesses affected, representing approximately 19,000 organisations facing ransom demands. The average cost of non-phishing cyber crime per business reached £990, rising to £1,970 excluding zero-cost responses, while cyber-facilitated fraud involving breaches leading to fraudulent activity carried average costs of £5,900, rising to £10,000 excluding zero-cost responses.
72-Hour Breach Notification Requirement: Under UK GDPR Article 33, controllers must notify the ICO of personal data breaches within 72 hours of becoming aware, unless the breach is unlikely to result in risk to individuals' rights and freedoms. Where breaches present high risk to affected individuals, Article 34 requires direct communication to those individuals without undue delay. Organisations must maintain breach registers documenting all incidents regardless of notification decisions, demonstrating compliance assessment processes and decision rationales for regulatory scrutiny.
Essential Cyber Security Measures for UK Data Protection 2026 Compliance
- Malware Protection (77% adoption): Anti-virus software, endpoint detection, and regular malware scanning across all devices accessing personal data
- Password Policies (73% adoption): Complex password requirements, multi-factor authentication, and privileged access management for sensitive systems
- Network Firewalls (72% adoption): Perimeter protection, network segmentation, and intrusion detection systems monitoring for suspicious activity
- Staff Security Training: Phishing awareness programmes, security culture development, and regular testing of employee responses to social engineering
- Incident Response Planning: Documented breach procedures, designated response teams, communication templates, and regular testing exercises
- Backup and Recovery: Regular data backups, offline backup storage, tested restoration procedures protecting against ransomware attacks
The National Cyber Security Centre (NCSC) managed 204 significant or highly significant cyber incidents during the year leading to September 2025, averaging one significant incident every two days with serious impacts on essential services, public safety, or economic stability. High-profile attacks including disruptions to Marks and Spencer, the Co-op, and NHS services through the Advanced Computer Software ransomware incident demonstrate the operational and reputational consequences extending beyond regulatory penalties, emphasising the business-critical importance of robust commercial dispute resolution and data protection frameworks.
Subject Access Requests and DSAR Changes Under DUAA 2025
Subject access requests continue representing significant compliance challenges for organisations, with the ICO receiving over 15,848 complaints relating to SARs during 2022-2023 alone, with failure to comply with DSARs constituting the most frequent complaint reason representing approximately one-third of all ICO complaints. The Data Use and Access Act 2025 codifies existing ICO guidance and case law while introducing changes affecting how organisations handle these requests, providing clearer parameters for compliance while maintaining individual access rights.
The Act codifies that organisations need only conduct "reasonable and proportionate" searches when responding to DSARs, reflecting the practical realities of locating personal data across complex organisational systems. This codification provides clearer defensibility for organisations demonstrating proportionate search approaches, though requirements for thorough searching where data clearly exists remain unchanged. Organisations should document search methodologies, systems searched, and decisions about search scope to demonstrate compliance if challenged either through ICO complaints or court proceedings.
DSAR Compliance Requirements and Best Practices
The standard one-month response timeframe remains unchanged under DUAA 2025, with extensions of up to two additional months permitted for complex requests or multiple simultaneous requests from the same individual. Importantly, the Act codifies the "stop the clock" principle whereby if organisations require further information from requesters to clarify request scope, the response period pauses until clarification is received. Organisations should ensure privacy notices and internal procedures reflect these timeframe provisions to manage requester expectations and maintain compliance.
New complaint handling requirements under DUAA 2025 mandate that organisations establish procedures facilitating complaints from individuals concerned about personal data processing breaches. While complaints to organisations before ICO escalation were already recommended practice, this becomes a formal requirement requiring electronic complaint submission options and outcome notification procedures. Organisations may face regulations requiring reporting of complaint volumes to the ICO, creating potential reputational exposure where high complaint volumes indicate systemic compliance issues affecting litigation and dispute resolution considerations.
Legal professional privilege protections receive explicit clarification under DUAA 2025, confirming that privileged information need not be disclosed in DSAR responses. Additionally, the Act introduces new court procedures for DSAR disputes, enabling courts to require disclosure of relevant data for judicial inspection without disclosure to data subjects until court rulings favour their claims. This provides organisations better protection against speculative or tactical DSARs while ensuring genuine access rights remain enforceable through judicial oversight where organisations wrongfully withhold personal data.
UK Data Protection 2026: Complete GDPR Compliance Guide for Businesses
Understanding UK Data Protection 2026 Changes and Business Compliance Requirements
UK data protection 2026 has entered a new era following the Data (Use and Access) Act receiving Royal Assent on 19 June 2025, introducing significant amendments to the UK GDPR, Data Protection Act 2018, and Privacy and Electronic Communications Regulations that every organisation processing personal data must understand. The regulatory landscape has intensified substantially, with ICO enforcement actions resulting in record fines including £14 million against Capita in October 2025 for inadequate cybersecurity measures, £3.07 million against Advanced Computer Software Group for ransomware vulnerabilities, and accumulated penalties exceeding £65 million under UK GDPR provisions since 2019.
The Cyber Security Breaches Survey 2025 reveals that 43% of UK businesses experienced cyber security breaches or attacks in the past twelve months, equivalent to approximately 612,000 organisations identifying breaches requiring notification assessment, incident response, and potential regulatory reporting. Ransomware attacks have doubled from less than 0.5% to 1% of businesses affected, representing an estimated 19,000 organisations experiencing ransom demands, while phishing attacks continue dominating the threat landscape affecting 85% of businesses and 86% of charities experiencing any breach.
Perhaps most significantly for compliance planning, the Data Use and Access Act 2025 has aligned PECR penalties with UK GDPR maximum fines, increasing potential sanctions for cookie consent and direct marketing violations from £500,000 to £17.5 million or 4% of annual worldwide turnover, whichever is higher. This fundamental shift transforms compliance priorities, making previously lower-risk marketing activities subject to enterprise-threatening financial exposure requiring immediate policy review and implementation updates across all organisations handling personal data.
Table Of Contents
Data Use and Access Act 2025 Key Changes for Organisations
The Data (Use and Access) Act 2025 represents the most significant reform to UK data protection law since Brexit, amending the UK GDPR, Data Protection Act 2018, and Privacy and Electronic Communications Regulations without replacing these foundational frameworks. The Act aims to simplify compliance burdens for organisations while maintaining high data protection standards and preserving the UK's European adequacy status, enabling continued personal data flows with EU member states essential for international business operations.
Key changes affecting organisations include the introduction of "recognised legitimate interests" providing clearer lawful processing grounds for crime prevention, safeguarding, and emergency response scenarios without requiring individual balancing tests. Scientific research provisions clarify that commercial research qualifies under research exemptions, with organisations permitted to seek "broad consent" for related research areas where specific purposes cannot be fully identified at collection. These research flexibilities prove particularly valuable for organisations developing AI systems and conducting commercial product development requiring personal data processing.
UK Data Protection 2026 Legislative Framework Summary
The automated decision-making provisions represent significant relaxation, permitting solely automated decisions affecting individuals on broader lawful bases beyond the previous restrictions to contractual necessity, legal requirement, or explicit consent. Organisations may now deploy automated systems including AI-based decisions on legitimate interests grounds for non-sensitive personal data, provided appropriate safeguards exist including information provision, contestation rights, and human intervention availability upon request, enabling greater operational efficiency in customer service, credit decisions, and recruitment processes within ICO data protection principles frameworks.
ICO Enforcement Trends and Penalties 2025
The Information Commissioner's Office enforcement activity during 2025 demonstrates continued regulatory vigilance, with significant penalties issued against organisations failing to implement adequate security measures and data protection frameworks. Between 2019 and September 2025, the ICO imposed 119 monetary penalty notices under PECR totalling approximately £10.5 million, alongside 16 UK GDPR fines totalling approximately £65 million excluding the overturned Clearview AI penalty, reflecting sustained enforcement commitment across both regulatory frameworks.
The October 2025 penalty against Capita stands as one of the most substantial ICO fines for cyber-related breaches, with Capita plc receiving £8 million as data controller and Capita Pension Solutions Limited receiving £6 million as data processor for failures enabling the March 2023 cyber attack compromising personal data of 6.6 million individuals. The breach exposed sensitive information including home addresses, passport images, financial details, and criminal records circulating on the dark web, with the ICO determining that inadequate security measures and delayed incident response constituted serious UK GDPR Article 5(1)(f) and Article 32 violations requiring substantial financial penalty following government data protection guidance principles.
Major UK GDPR and PECR Enforcement Actions 2019-2025
ICO enforcement priorities for 2025-2026 continue focusing on children's privacy, online advertising practices, and cookie consent compliance. The national cookies compliance check expanded to include the UK's top 1,000 websites during January 2025, with the ICO expressing concern that many organisations fail to follow guidance on website design and fail to provide users adequate choice regarding tracking for personalised marketing. The ICO's September 2025 consultation on online advertising reform signals potential further secondary legislation creating additional cookie consent exceptions for low-risk advertising activities, though organisations should maintain cautious compliance approaches until regulatory clarity emerges.
PECR Cookie Consent and Marketing Compliance 2025
The Privacy and Electronic Communications Regulations 2003 amendments under the Data Use and Access Act 2025 fundamentally transform the UK data protection 2026 compliance landscape by aligning maximum penalties with UK GDPR sanctions. Previously, PECR violations including cookie consent failures and direct marketing breaches faced maximum fines of £500,000, creating disproportionate risk exposure compared to UK GDPR security breaches. Following DUAA implementation, PECR violations now attract potential penalties of £17.5 million or 4% of annual worldwide turnover, whichever is higher, making marketing compliance as financially significant as data security compliance.
New cookie consent exceptions under Schedule A1 PECR permit storage and access technologies without explicit consent in specific low-risk circumstances. Cookies collecting information for statistical purposes about service usage with improvement aims no longer require opt-in consent, provided users receive transparency about purposes and have objection mechanisms available. Similarly, cookies enabling appearance or functionality adaptation to user device preferences qualify for exemption, potentially simplifying cookie banners for organisations deploying only essential and analytics functionality without cross-site tracking or advertising purposes.
Cookie Consent Requirements Following DUAA 2025
Direct marketing compliance under PECR continues requiring careful attention following penalty alignment. The ICO has maintained active enforcement against unsolicited marketing communications, with telemarketing companies receiving substantial fines for calls to individuals registered with the Telephone Preference Service. DUAA 2025 introduces "soft opt-in" provisions for charities, permitting electronic mail marketing to individuals whose personal information was collected when they supported, or expressed interest in, charitable purposes, unless they object. This mirrors the existing soft opt-in available to commercial organisations marketing similar products to existing customers, expanding compliant direct marketing opportunities for the charitable sector.
Data Breach Notification and Cyber Security Requirements
The Cyber Security Breaches Survey 2025 reveals the persistent threat landscape facing UK organisations, with 43% of businesses and 30% of charities experiencing cyber security breaches or attacks during the past twelve months. This represents approximately 612,000 UK businesses and 61,000 charities identifying breaches requiring assessment against notification obligations, incident response procedures, and potential regulatory reporting depending on risk levels to affected individuals.
Medium and large businesses face particularly elevated exposure, with 67% of medium businesses and 74% of large businesses reporting breaches or attacks. Phishing attacks dominate the threat landscape, affecting 85% of businesses and 86% of charities experiencing any breach, while ransomware incidents have doubled from less than 0.5% to 1% of businesses affected, representing approximately 19,000 organisations facing ransom demands. The average cost of non-phishing cyber crime per business reached £990, rising to £1,970 excluding zero-cost responses, while cyber-facilitated fraud involving breaches leading to fraudulent activity carried average costs of £5,900, rising to £10,000 excluding zero-cost responses.
Essential Cyber Security Measures for UK Data Protection 2026 Compliance
The National Cyber Security Centre (NCSC) managed 204 significant or highly significant cyber incidents during the year leading to September 2025, averaging one significant incident every two days with serious impacts on essential services, public safety, or economic stability. High-profile attacks including disruptions to Marks and Spencer, the Co-op, and NHS services through the Advanced Computer Software ransomware incident demonstrate the operational and reputational consequences extending beyond regulatory penalties, emphasising the business-critical importance of robust commercial dispute resolution and data protection frameworks.
Subject Access Requests and DSAR Changes Under DUAA 2025
Subject access requests continue representing significant compliance challenges for organisations, with the ICO receiving over 15,848 complaints relating to SARs during 2022-2023 alone, with failure to comply with DSARs constituting the most frequent complaint reason representing approximately one-third of all ICO complaints. The Data Use and Access Act 2025 codifies existing ICO guidance and case law while introducing changes affecting how organisations handle these requests, providing clearer parameters for compliance while maintaining individual access rights.
The Act codifies that organisations need only conduct "reasonable and proportionate" searches when responding to DSARs, reflecting the practical realities of locating personal data across complex organisational systems. This codification provides clearer defensibility for organisations demonstrating proportionate search approaches, though requirements for thorough searching where data clearly exists remain unchanged. Organisations should document search methodologies, systems searched, and decisions about search scope to demonstrate compliance if challenged either through ICO complaints or court proceedings.
DSAR Compliance Requirements and Best Practices
The standard one-month response timeframe remains unchanged under DUAA 2025, with extensions of up to two additional months permitted for complex requests or multiple simultaneous requests from the same individual. Importantly, the Act codifies the "stop the clock" principle whereby if organisations require further information from requesters to clarify request scope, the response period pauses until clarification is received. Organisations should ensure privacy notices and internal procedures reflect these timeframe provisions to manage requester expectations and maintain compliance.
New complaint handling requirements under DUAA 2025 mandate that organisations establish procedures facilitating complaints from individuals concerned about personal data processing breaches. While complaints to organisations before ICO escalation were already recommended practice, this becomes a formal requirement requiring electronic complaint submission options and outcome notification procedures. Organisations may face regulations requiring reporting of complaint volumes to the ICO, creating potential reputational exposure where high complaint volumes indicate systemic compliance issues affecting litigation and dispute resolution considerations.
Legal professional privilege protections receive explicit clarification under DUAA 2025, confirming that privileged information need not be disclosed in DSAR responses. Additionally, the Act introduces new court procedures for DSAR disputes, enabling courts to require disclosure of relevant data for judicial inspection without disclosure to data subjects until court rulings favour their claims. This provides organisations better protection against speculative or tactical DSARs while ensuring genuine access rights remain enforceable through judicial oversight where organisations wrongfully withhold personal data.
Frequently Asked Questions
What are the maximum UK data protection 2026 fines under DUAA?
Maximum fines under UK data protection 2026 legislation reach £17.5 million or 4% of annual worldwide turnover, whichever is higher, for serious UK GDPR breaches. The Data Use and Access Act 2025 aligned PECR maximum penalties with these levels, increasing potential fines for cookie consent and direct marketing violations from the previous £500,000 cap. This represents the most significant change affecting marketing compliance, making previously lower-risk activities subject to enterprise-threatening financial exposure requiring immediate policy review.
How does the Data Use and Access Act 2025 change cookie consent requirements?
DUAA 2025 introduces new cookie consent exceptions permitting certain cookies without explicit opt-in consent. First-party analytics cookies collecting statistical information for service improvement purposes no longer require consent, provided users receive transparency about purposes and have opt-out mechanisms available. Functionality cookies adapting website appearance or operation to user device preferences also qualify for exemption. However, advertising, marketing, and third-party tracking cookies continue requiring explicit consent, maintaining protection against invasive cross-site tracking and profiling activities.
What is the 72-hour data breach notification requirement?
UK GDPR Article 33 requires controllers to notify the ICO of personal data breaches within 72 hours of becoming aware, unless the breach is unlikely to result in risk to individuals' rights and freedoms. Where breaches present high risk to affected individuals, Article 34 requires direct communication without undue delay. Organisations must maintain breach registers documenting all incidents regardless of notification decisions, demonstrating compliance assessment processes and decision rationales. Failure to notify notifiable breaches attracts regulatory penalties and evidences accountability failures.
How long do organisations have to respond to subject access requests?
Organisations must respond to subject access requests within one month of receipt without undue delay. Extensions of up to two additional months are permitted for complex requests or where individuals submit multiple simultaneous requests, provided requesters receive notification within the initial month explaining extension reasons. DUAA 2025 codifies the "stop the clock" principle, pausing response periods while organisations await clarification from requesters about request scope. DSARs need not use specific phrases—any request clearly seeking personal data qualifies regardless of terminology used.
What percentage of UK businesses experienced cyber breaches in 2025?
The Cyber Security Breaches Survey 2025 reports that 43% of UK businesses experienced cyber security breaches or attacks during the past twelve months, representing approximately 612,000 organisations. Medium businesses showed 67% breach rates while large businesses faced 74% exposure. Phishing attacks affected 85% of breached organisations, while ransomware incidents doubled from less than 0.5% to 1% of businesses affected—approximately 19,000 organisations experiencing ransom demands. These statistics underscore the importance of robust technical and organisational security measures for UK data protection 2026 compliance.
What are recognised legitimate interests under DUAA 2025?
DUAA 2025 introduces "recognised legitimate interests" providing clearer lawful processing grounds for specific purposes without requiring individual balancing tests. These include crime prevention, safeguarding vulnerable individuals, responding to emergencies, and other specified legitimate interests where processing is clearly justified. This simplifies compliance for organisations processing personal data for protective purposes, removing uncertainty about balancing exercise outcomes while maintaining individual rights through other safeguards. Standard legitimate interests processing outside recognised categories continues requiring traditional balancing assessments.
How does UK data protection 2026 affect automated decision-making?
DUAA 2025 significantly relaxes automated decision-making restrictions for non-sensitive personal data. Previously, solely automated decisions with significant effects required contractual necessity, legal requirement, or explicit consent as lawful bases. The Act permits such decisions on broader lawful bases including legitimate interests, provided appropriate safeguards exist. These safeguards include informing individuals about automated decisions, providing contestation rights, and enabling human intervention upon request. Processing special category data through automated decision-making retains stricter requirements including substantial public interest conditions.
What new complaint handling requirements exist under DUAA 2025?
DUAA 2025 mandates that organisations establish procedures facilitating complaints from individuals concerned about personal data processing breaches. This includes providing electronic complaint submission options such as online forms, and informing individuals about complaint outcomes. While direct complaints to organisations before ICO escalation were previously recommended practice, this becomes a formal legal requirement. The Secretary of State may introduce regulations requiring organisations to report complaint volumes to the ICO, potentially creating reputational exposure for organisations with high complaint levels indicating systemic compliance issues.
Expert Data Protection Legal Guidance
✓ Compliance Framework Review
Comprehensive assessment of existing data protection policies against DUAA 2025 requirements, identifying gaps and developing implementation roadmaps for updated compliance frameworks
✓ Data Breach Response
Expert guidance on breach assessment, notification obligations, regulatory engagement strategies, and individual communication requirements during cyber incidents and data security events
✓ DSAR and Litigation Support
Strategic advice on complex subject access requests, exemption application, third-party data considerations, and defence against data protection claims and regulatory enforcement actions
UK data protection 2026 presents significant compliance challenges following the Data Use and Access Act reforms, with aligned PECR penalties transforming marketing risk profiles, ICO enforcement actions producing record fines exceeding £14 million, and cyber threats affecting 43% of UK businesses. Understanding evolving requirements proves essential for organisations seeking to protect both operational continuity and regulatory standing.
The phased implementation timeline between June 2025 and June 2026 creates ongoing compliance obligations requiring systematic policy reviews, updated privacy notices, enhanced complaint handling procedures, and strengthened security measures. Professional guidance ensures organisations navigate these changes effectively while maximising opportunities created by relaxed cookie consent rules, simplified research provisions, and broader automated decision-making permissions.
For expert guidance on UK data protection 2026 compliance, contact Connaught Law's specialist team. Our commercial litigation and data protection experts provide comprehensive support for organisations navigating DUAA implementation, breach response, DSAR management, and ICO regulatory engagement ensuring optimal outcomes through professional legal coordination and strategic compliance framework development.
Disclaimer:
The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Connaught Law and authors accept no responsibility for loss that may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please don't hesitate to contact Connaught Law. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Connaught Law.