Important changes to UK data protection law came into force on 5th February 2026 under the Data (Use and Access) Act 2025.
The good news is that most of these changes make compliance easier rather than adding new burdens. Below is a summary of what’s changed and what (if anything) you need to do.
Data Subject Access Requests (DSARs)
You can now formally “stop the clock” on DSAR response deadlines while waiting for clarification from the requester. This was already ICO guidance, but it’s now statutory. The law also confirms that searches must be “reasonable and proportionate”.
Action: Update your DSAR procedures to document when and how you request clarification.
Automated Decision-Making
The prohibition on automated decision-making has been significantly relaxed. You can now make automated decisions (including using AI) without explicit consent, provided:
- You’re not processing special category data (health, ethnicity, etc.)
- You provide appropriate safeguards (information, right to contest, human review)
Action: If you use automated decision-making, review whether you can simplify your approach.
Legitimate Interests
A new lawful basis called “recognised legitimate interests” is available for specific purposes including crime prevention, emergencies, and safeguarding. For these purposes, you don’t need to do a balancing test. There’s also a helpful list of examples for standard legitimate interests (like direct marketing and intra-group sharing), though these still require a legitimate interests assessment (and aren’t really anything we didn’t already know anyway).
International Data Transfers
A more flexible “data protection test” now applies – the recipient country’s standards must not be “materially lower” than the UK’s (rather than “essentially equivalent”). This is particularly useful when considering Transfer Risk Assessments (TRA) although in reality is unlikely to make that much difference.
Cookie Rules (PECR)
Consent requirements have been relaxed for certain cookies used only for statistics or functionality, provided you offer an opt-out. However, penalties for PECR breaches have increased dramatically – from £500,000 to £17.5 million or 4% of global turnover.
Services Accessed by Children
If your services are likely to be accessed by children, you must now consider “children’s higher protection matters” in your design, including age-appropriate safeguards and awareness of children’s rights. Essentially the Children’s Code is now statutory and applies to any service likely to be accessed by a child, rather than services aimed at children.
What’s Still to Come
The process for handling complaints which the Act introduces is still outstanding, due to take effect 19th June 2026. Essentially, data subjects will have a statutory right to complain directly to you. You’ll need to acknowledge complaints within 30 days and respond “as soon as possible”. The ICO have now published their guidance since their consultation, so I’ll provide further guidance on this shortly.”
