Legal updates
6 mins read
Updated on 10 March 2026
Our subject expert
David Sant
Senior Solicitor - Commercial Technology & Data Protection
From 5 February 2026, most key data protection changes under the Data (Use and Access) Act 2025 (DUAA) came into force and reshaped how UK organisations need to apply parts of the UK GDPR, the Data Protection Act 2018 and PECR in practice.
The DUAA updates the UK privacy rulebook in a targeted way across a number of areas that many SMEs deal with every day including: cookies and tracking, automated decisions and children’s safeguards, with a strict new complaints handling requirement coming in June.
If you’re responsible for customer, employee or website data, you should check what’s changed now and make sure your set-up and processes reflect it - especially where direct marketing and cookies are involved.
While changes under the DUAA aim to streamline and simplify, the consequences of getting certain things wrong make this a significant governance and board-level priority. PECR fines (covering cookies and electronic direct marketing) can now reach UK GDPR levels - up to £17.5m or 4% of worldwide turnover, whichever is higher – raising the stakes for compliance. And tougher expectations on handling data protection complaints will follow in just a few months. You should start implementing changes now, but remember to check for new ICO guidance as it’s released so you’re aligned.
Below is a brief overview of some key changes to know, what’s coming next, and examples of practical steps you can take to stay compliant.
Most key updates came into force on 5 February 2026 and are now live. So now is the time to focus on compliance to avoid risk and damage to your reputation. Key focus areas include:
The DUAA makes targeted changes to cookie consent rules, which will matter if you use analytics tools on your website.
The DUAA strengthens the focus on children’s protection in the UK privacy framework. Providers of online services likely to be accessed by children must now explicitly consider ‘children’s higher protection matters’ as part of their data protection by design approach.
The DUAA adjusts how the UK rules apply to automated decision-making (ADM), which could impact some AI-driven decision-making.
There is now a new lawful ground for processing personal data.
The DUAA also strengthens the regulator’s toolkit.
From 19 June 2026, businesses will need to have a way for people to raise data protection complaints - and a process to handle them properly.
You’ll also need the ability to acknowledge and handle complaints within specific timeframes, with records of what you did and why.
PECR, UK GDPR and the DPA 2018 are still in force and still mandatory. The DUAA doesn’t replace them; it amends them. So, remember to keep complying with these laws but understand how the DUAA’s changes impact your obligations under them.
To keep your compliance actions manageable, focus on a set of practical actions that will bring your day-to-day compliance up to date. You don’t need to rebuild everything if you already have strong compliance in place, but you should revisit your policies and processes to align with DUAA changes and ICO guidance. You should also consider where your risk lies (eg. increased PECR fines) and take steps to mitigate those risks.
Remember the DUAA’s impact isn’t one-size-fits-all and depends on your business and its activities - so take legal advice to properly understand what to do.
If you need support with any aspect of your privacy approach, do get in touch – our expert data protection solicitors can review your current position and help you put proportionate measures in place to stay compliant while supporting your business’s growth.
You can keep on top of DUAA developments and guidance by following updates from the ICO – which is transitioning to the Information Commission governance structure under the DUAA – via its website, newsletters and consultations.
We’ll also continue to share practical insights as the reforms roll out and new guidance lands, so you can stay ahead of what you need to change and when.
Legal updates
6 November 2026
Legal updates
6 November 2026
Legal updates
30 October 2026
Legal updates
28 October 2026
Legal updates
27 October 2026
To access legal support from just £174 per hour arrange your no-obligation consultation today. We aim to respond to all messages received within 24 hours.