TRW & Co · Data protection
Data (Use and Access) Act 2025: What Has Changed
The Data Use and Access Act amends the UK GDPR, the Data Protection Act 2018 and PECR. As of October 2026, most of it is in force: recognised legitimate interests, new automated decision-making rules, cookie exemptions and higher PECR fines from 5 February 2026, a complaints duty from 19 June 2026, and the Information Commission from 30 September 2026.
Key pointThe changes that most raise risk are not the deregulatory ones: PECR fines now reach UK GDPR levels and every controller must run a documented complaints process, so cookies, marketing and complaints should be fixed first.
At a glance
Royal Assent
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and has been commenced in stages through a series of commencement regulations.
Main changes in force
Recognised legitimate interests, automated decision-making reform, cookie exemptions, transfer rules and higher PECR penalties took effect on 5 February 2026.
Complaints duty
Since 19 June 2026 controllers must facilitate data protection complaints, acknowledge them within 30 days and respond without undue delay.
Higher PECR fines
The maximum PECR penalty rose from £500,000 to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
Information Commission
On 30 September 2026 the Information Commissioner's Office became the Information Commission, a board-led regulator that still uses the ICO name.
Swipe or scroll →
The short answer: what the Data Use and Access Act changed
The Data Use and Access Act (formally the Data (Use and Access) Act 2025) is the first major reform of UK data protection law since Brexit. It amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) rather than replacing them. Most of its data protection changes took effect on 5 February 2026, a new complaints duty followed on 19 June 2026, and the Information Commissioner's Office became the Information Commission on 30 September 2026.
For businesses, the practical headlines are: a new "recognised legitimate interests" lawful basis; a more permissive regime for automated decision-making; statutory rules on subject access time limits and searches; new cookie exemptions; PECR fines raised to UK GDPR levels; and a duty to handle data protection complaints in-house. The Act does not remove the core UK GDPR principles, so existing compliance programmes still stand, but most need updating.
When each part of the Data Use and Access Act took effect
The Act received Royal Assent on 19 June 2025 and has been brought into force in stages by commencement regulations. The main data protection package was commenced by the Commencement No. 6 Regulations, made on 29 January 2026.
| Date | What took effect | Who should act |
|---|---|---|
| 19 June 2025 (Royal Assent) | Subject access searches limited to what a reasonable and proportionate search finds (treated as in force from 1 January 2024) | Anyone handling access requests |
| 20 August 2025 | First commencement, including the 72-hour deadline for PECR personal data breach notifications | Telecoms and internet service providers |
| 1 December 2025 | Most of the digital verification services framework | Identity and verification providers |
| 5 February 2026 | Recognised legitimate interests, automated decision-making, purpose limitation, research, international transfers, subject access time limits, cookie exemptions, higher PECR fines, new ICO powers | Almost every controller |
| 19 June 2026 | Duty on controllers to facilitate, acknowledge and respond to data protection complaints | Every controller |
| 30 September 2026 | Information Commissioner replaced by the Information Commission, a board-led body | No new obligations; update references |
A small number of provisions, including some regulation-making powers, depend on further secondary legislation. Check the commencement status of any specific section on legislation.gov.uk before relying on it.
Lawful basis: recognised legitimate interests
The Act adds a new lawful basis in Article 6(1)(ea) of the UK GDPR: processing necessary for a "recognised legitimate interest". It applies only where a condition in the new Annex 1, inserted by Schedule 4, is met. Those conditions cover disclosures to public bodies that request data for their public tasks, national security, public security and defence, emergencies, the prevention and detection of crime, and safeguarding vulnerable individuals.
The key difference from ordinary legitimate interests is that no balancing test is needed. If the condition is met, the controller does not have to weigh its interests against the individual's. That is a real simplification for, say, a business disclosing information to the police or acting on a safeguarding concern, but it does not displace the other principles, such as minimisation and security.
Clarified examples of legitimate interests
Separately, the Act lists processing that may be necessary for ordinary legitimate interests: direct marketing, intra-group transmission of personal data for internal administrative purposes, and ensuring the security of network and information systems. The balancing test still applies to these, so a legitimate interests assessment remains good practice. The list removes doubt rather than granting a new right.
Automated decision-making and AI
The old Article 22 was, in effect, a prohibition on solely automated decisions with legal or similarly significant effects, subject to narrow exceptions. The Act replaces it with new Articles 22A to 22D. A decision is "solely automated" where there is no meaningful human involvement, and the extent of profiling is relevant to that assessment.
Under the new approach, significant automated decisions are generally permitted, provided safeguards are in place, such as telling individuals about the decision, letting them make representations, obtaining human intervention and contesting the result. Tighter restrictions remain where the decision is based on special category data, which requires explicit consent or a contractual or legal basis combined with a substantial public interest condition, and where processing relies on recognised legitimate interests.
For businesses deploying AI in recruitment, lending, insurance or fraud screening, this is the most commercially significant change in the Data Use and Access Act. It makes automated decisions easier to justify, but the safeguards must work in practice. Our AI team and our guide to AI regulation in the UK cover the wider framework.
The Act makes automated decisions easier to justify, but only for organisations that can show a human can genuinely review and change the outcome.
Subject access and the new complaints duty
Two changes affect how organisations handle requests from individuals. First, section 78 confirms that a requester is entitled only to what the controller can find through a reasonable and proportionate search. The Act treats this as having applied from 1 January 2024, which matters for disputes over older requests.
Second, the time limit rules are now in statute. The one-month period starts from the latest of receipt of the request, receipt of any identity information requested and payment of any permitted fee. It can be extended by two further months for complex or numerous requests, and the clock stops while the controller waits for clarification it reasonably needs. Our guide to the subject access request process explains these in detail.
From 19 June 2026, section 103 requires controllers to facilitate complaints about data protection infringements, for example with an electronic complaint form; acknowledge each complaint within 30 days; and respond without undue delay, including keeping the complainant informed of progress. The regulator expects individuals to complain to the controller first, so a weak complaints process now feeds directly into regulatory scrutiny.
Cookies, marketing and higher PECR fines
The Act changes PECR in three ways that matter to marketing and digital teams. Consent is no longer needed for certain low-risk cookies and similar technologies, including those used to collect statistics to improve a service, to improve a website's appearance or performance, for emergency assistance, and for strictly necessary purposes such as security and fraud detection. Users must still be given clear information and a simple way to object.
Charities can now use the "soft opt-in" for email marketing to supporters, as businesses already could for customers. And the maximum PECR penalty rises from £500,000 to the UK GDPR higher maximum of £17.5 million or 4% of worldwide annual turnover, whichever is higher. Unlawful cookies and nuisance marketing are no longer low-cost risks. See our guide to cookies and PECR for a practical audit.
Transfers, research and the Information Commission
International transfers now turn on a "data protection test": whether the standard of protection in the destination is not materially lower than in the UK. The same test applies to the Secretary of State's adequacy-type regulations and to controllers using transfer mechanisms. This gives more flexibility but still needs documented assessments, discussed in our guide to international data transfers.
The Act also broadens the definition of scientific research, allows broad consent for research areas, and clarifies when further processing is compatible with the original purpose. Commercial research and product development can benefit, provided appropriate safeguards are applied.
On 30 September 2026, the ICO became the Information Commission, a corporate body led by a board rather than a single commissioner. The familiar acronym continues. The regulator also has new powers, including interview notices and the power to require technical reports, which make investigations more intrusive.
Smart data and digital verification services
The Data Use and Access Act is not only about data protection. Part 1 gives the government powers to create "smart data" schemes, which require businesses in designated sectors to share customer data, at the customer's request, with authorised third parties. The model is open banking, extended to other markets over time. Each scheme depends on its own regulations, so businesses should watch for sector-specific consultations; our guide to smart data and open finance follows them.
Part 2 creates a statutory framework for digital verification services, including a register of certified providers and a trust framework. Most of it took effect on 1 December 2025. It is relevant to identity providers and to organisations that rely on digital identity checks, for example in onboarding or employment.
Cross-border groups and Bangladesh
For international groups, the Data Use and Access Act widens the gap between UK and EU rules. A group with operations in London, the EU and Bangladesh may now need three positions on lawful basis, automated decisions and cookies. Bangladesh has been developing its own personal data protection framework, so group data-sharing and transfer documents should be reviewed in both directions rather than assuming a single global standard. Where data flows from the UK to Bangladesh or the Gulf, the new data protection test for transfers applies.
Updating your compliance programme
- Map what changed for you. Identify which reforms touch your processing: legitimate interests, AI and automated decisions, cookies, marketing, research, transfers or access requests.
- Revisit lawful bases. Decide whether any processing can move to a recognised legitimate interest, and update legitimate interests assessments for direct marketing, intra-group sharing and security.
- Re-paper automated decisions. List significant automated decisions, confirm whether special category data is used and document the safeguards and human review route.
- Refresh the cookie banner. Reclassify analytics and performance cookies against the new exemptions, keeping the information and objection mechanism.
- Update access request procedures. Build the new clock-start and stop-the-clock rules into templates and document what a reasonable and proportionate search looks like for your systems.
- Stand up a complaints process. Publish an electronic complaint route, set a 30-day acknowledgement target and record outcomes.
- Update privacy notices and training. Reflect the new lawful basis, automated decision safeguards, complaints route and the regulator's new name.
Many organisations treated the Data Use and Access Act as "deregulation" and paused work. In practice the cookie and PECR changes raise penalty exposure, and the complaints duty creates a new documented obligation. Both are visible to customers and regulators, so they should come first in any update plan.
Illustrative scenario: a fintech using automated credit decisions
This scenario is illustrative only. A UK consumer lender uses an AI model to approve or decline small loans without human review. Before February 2026 it relied on the contractual necessity exception to the old Article 22 and offered a human review on request.
Under the new rules, the lender can continue to make solely automated decisions, but it should check that the model does not use special category data, including inferred data such as health indicators. If it does, the stricter conditions apply. It must also ensure that customers are told about the decision, can make representations, can obtain human intervention and can contest the outcome, and that the reviewer can actually override the model.
The lender's cookie banner, marketing consents and complaints form also need updating. Because consumer credit is FCA-regulated, it should also check that its approach is consistent with the Consumer Duty. Our fintech team handles the regulatory and data protection points together.
Risks and common misunderstandings
"Recognised legitimate interests replaces the balancing test"
Only for the listed Annex 1 purposes, such as crime prevention, safeguarding and emergencies. Ordinary commercial processing, including direct marketing, still relies on Article 6(1)(f) and needs the balancing test. Treating marketing as a recognised legitimate interest is a mistake regulators are likely to spot quickly, because the statutory list is short and specific.
"Automated decisions no longer need safeguards"
The new Articles make automated decisions easier to justify but require safeguards, and the restrictions on special category data remain. A nominal human sign-off does not prevent a decision from being solely automated if the human has no meaningful role. Organisations should test whether reviewers have the authority, information and time to change outcomes.
"Cookie consent is no longer needed"
Only for the specified low-risk purposes. Advertising, cross-site tracking and most third-party cookies still need consent. With PECR fines now aligned to UK GDPR levels, an inaccurate cookie banner carries far more risk than before. Users must still receive clear information and a free, simple way to object to exempt cookies.
"The EU GDPR position is unchanged, so nothing changes for us"
Businesses subject to both regimes now operate two diverging laws. Recognised legitimate interests, the new automated decision rules and the cookie exemptions have no direct EU equivalent. Group policies should state which standard applies where, and EU-facing processing should still meet the EU rules. Also keep an eye on the EU's adequacy decisions for the UK, which underpin data flows from the EU.
What to do next
As of October 2026, the Data Use and Access Act is largely in force. Priorities now are cookies and marketing, automated decisions, access request procedures and the complaints process, followed by updated privacy notices. Our data protection solicitors can run a gap analysis against the new rules, and our guide to the UK GDPR compliance checklist shows how the changes fit the wider framework.
To discuss how the Act affects your organisation, contact our London office or email info@trw.co.
Frequently asked questions
01Is the Data (Use and Access) Act 2025 in force?
Mostly. The Act received Royal Assent on 19 June 2025. The main data protection and PECR changes took effect on 5 February 2026, the duty to handle complaints took effect on 19 June 2026, and the Information Commission replaced the Information Commissioner on 30 September 2026. A few provisions depend on further regulations. Check the commencement information for any particular section on legislation.gov.uk before relying on it.
02Does the Act replace the UK GDPR?
No. It amends the UK GDPR, the Data Protection Act 2018 and PECR. The core principles, lawful bases, rights and security duties remain, as do the 72-hour breach notification rule and the maximum UK GDPR fines. Existing compliance programmes therefore remain valid, but privacy notices, lawful basis records, cookie banners, access request procedures and complaints handling need updating.
03What is a recognised legitimate interest?
It is a new lawful basis in Article 6(1)(ea) of the UK GDPR. It applies only to purposes listed in Annex 1: disclosures to public bodies for their public tasks, national security and defence, emergencies, crime prevention and detection, and safeguarding vulnerable individuals. No balancing test is required for these purposes. Ordinary commercial activities such as direct marketing still rely on standard legitimate interests, with a balancing test.
04Can we now use AI to make automated decisions about people?
More readily than before. Solely automated decisions with legal or similarly significant effects are generally permitted, provided safeguards are in place, such as informing the individual, allowing representations, offering human intervention and allowing the decision to be contested. Stricter conditions apply where special category data is used or where processing relies on a recognised legitimate interest. Sector rules, such as FCA requirements and equality law, still apply.
05Do we still need cookie consent?
For most cookies, yes. The Act exempts specified low-risk purposes from consent, such as statistics to improve a service, improving a website's appearance or performance, and strictly necessary purposes including security and fraud prevention. Users must still get clear information and a way to object. Advertising and tracking cookies still need consent, and PECR fines can now reach £17.5 million or 4% of worldwide turnover.
06What must our complaints process include?
Since 19 June 2026, controllers must make it easy to complain about data protection infringements, for example by providing an electronic complaint form, acknowledge each complaint within 30 days, take appropriate steps to respond (including making enquiries and updating the complainant on progress) and tell the complainant the outcome without undue delay. Regulations may later require controllers to report complaint numbers to the regulator.
Sources and official materials
- Data (Use and Access) Act 2025 — Full text and commencement information
- Commencement No. 6 Regulations 2026 (SI 2026/82) — Brought the main data protection changes into force
- Section 103: complaints by data subjects — The new controller complaints duty
- Schedule 4: recognised legitimate interests — Annex 1 conditions for the new lawful basis
- UK GDPR Article 22A: automated decision-making — Definitions for the new ADM regime
- Information Commission (ICO) — Regulator guidance on the changes
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.