The short version
- The ICO says all the data protection provisions of the Act are in force as of 19 June 2026, a year after Royal Assent.
- Nearly every organisation must act on one change. Give people a way to make a data protection complaint, acknowledge it within 30 days and respond without undue delay.
- The Act amends the UK GDPR, the Data Protection Act 2018 and PECR without replacing them. Fines under PECR can now reach £17.5 million or 4% of global turnover.
On 19 June 2026 the last of the data protection changes in the Data (Use and Access) Act 2025 came into force. That was a year to the day after it received Royal Assent. The Information Commissioner’s Office (ICO) now says that all the provisions affecting data protection law are live. The same goes for the provisions affecting the Privacy and Electronic Communications Regulations (PECR). If you run a UK business and filed the Act under “look at this later”, later has arrived.
The Act is less dramatic than its length suggests. It amends the UK GDPR, the Data Protection Act 2018 and PECR without replacing them. The ICO’s summary for organisations says most of the changes offer a chance to do things differently. They do not require specific action to stay within the law. There is one clear exception, covered below. As ever, this is analysis of what the official sources say. It is not legal advice.
How the Act arrived
The government brought the Act into force in stages. The Department for Science, Innovation and Technology (DSIT) keeps a commencement page listing the regulations.
| Date | What came into force |
|---|---|
| 19 June 2025 | Royal Assent. |
| 20 August 2025 | First commencement regulations: technical provisions and new statutory objectives for the ICO. |
| 30 September 2025 | Section 124, which amends the Online Safety Act so that online services can be required to retain information when a coroner is investigating the death of a child. |
| 1 December 2025 | Most of Part 2, putting the UK digital identity and attributes trust framework on a statutory footing. |
| 5 February 2026 | The majority of the data protection and privacy provisions in Part 5. |
| 19 June 2026 | The duty on organisations to handle data protection complaints. |
One caution on sources. The DSIT page was last updated on 5 February 2026. It still describes the complaints duty as something expected about 12 months after Royal Assent. The confirmation that it happened comes from the ICO. It announced in June 2026 that the new requirements were in force.
The one thing nearly every organisation must do
Section 103 of the Act inserts a new section 164A into the Data Protection Act 2018. In outline, a controller must do three things. It must make it easy for people to complain about how their personal data is handled. The Act gives an electronic complaint form as an example. It must acknowledge a complaint within 30 days. It must without undue delay take appropriate steps to respond and tell the person the outcome.
The ICO’s complaints guidance fills in the practical detail:
- You do not need a separate tool. An existing complaints process can be adapted to include data protection complaints.
- People are not obliged to use your form. A complaint can arrive through any channel, including social media.
- An automatic email reply can serve as the acknowledgement for complaints received electronically.
- The 30 days run from the day after the complaint is received. If the last day falls on a weekend or public holiday, you have until the next working day.
- The duty to investigate starts when the complaint arrives. It does not wait for the acknowledgement period to end. What counts as undue delay depends on the circumstances.
- Tell people they can complain to you, for example in your privacy notice. Keep a record of what you received and did.
The ICO says its focus is on helping organisations build good practice. It says it is not trying to catch businesses out. It also cites findings about businesses that were aware of the Act. More than two in three either did not know whether the change applied to them or wrongly thought it did not.
There is a second new requirement with a narrower reach. If you provide an online service likely to be used by children, the Act is explicit. You must take their needs into account when deciding how to use their personal information. The ICO says services that already conform to its Age appropriate design code should satisfy this.
The changes you can choose to use
The rest of the list, as the ICO summarises it, is mostly permissive:
- Recognised legitimate interests. A new lawful basis for certain specified purposes, such as protecting public security. It removes the usual balancing test.
- Automated decision-making. A wider range of lawful bases for significant automated decisions, provided safeguards are applied. That could include legitimate interests. This does not extend to special category data.
- Subject access requests. The Act makes clear that only reasonable and proportionate searches are required.
- Clarifications. The law now states that direct marketing can be a legitimate interest. It also rewords the test for transferring personal information outside the UK.
Cookies: more room, with conditions
The Act widens the circumstances in which a website can store or read information on a visitor’s device without consent. The ICO published final guidance on this in April 2026. It lists five exceptions. They include one for collecting statistics about how a service is used and one for adapting its appearance to a user’s preference.
Those two come with conditions. You must give clear information about the technology and a simple, free way to object. The guidance is also blunt that advertising purposes never meet the “strictly necessary” exception. So this is not a licence to delete the cookie banner. It is a reason to check what each cookie is for. (This site avoids the question by setting none. See the privacy page.)
Stronger powers for the regulator
The ICO gains the power to compel witnesses to attend interviews and to request technical reports. It can also issue fines under PECR of up to £17.5 million or 4% of global turnover. In its one year on update, the ICO said it is developing separate guidance on the higher PECR fines. It said it will use its new powers where necessary in the most serious cases.
PECR is the law behind marketing emails, texts and cookies. So in my view that higher ceiling is the part of the Act marketing teams should take most seriously.
A loose end: the Information Commission
Part 6 of the Act is headed “The Information Commission”. It changes how the regulator is governed. DSIT’s page says those changes will take place once the members of the Information Commission’s new board have been appointed. The ICO’s February 2026 statement said some governance provisions would follow at a later date. I could not confirm from an official source that the changeover has happened. As of October 2026 the regulator’s website still uses the ICO name, so this article does too.
What to do now
- Give people a clear route for data protection complaints (a form or a monitored email address) and mention it in your privacy notice.
- Set up an acknowledgement that goes out within 30 days. An automatic reply is acceptable for electronic complaints.
- Decide who investigates. Record what was received, what was done and what the person was told.
- Check your cookies against the ICO’s five exceptions before changing any consent banner. Offer a simple way to object where the exception requires one.
- If you make significant automated decisions or want to rely on a new lawful basis, read the updated ICO guidance first.
- If children are likely to use your online service, check it against the Age appropriate design code.
- Keep existing compliance work in place. The UK GDPR, the Data Protection Act 2018 and PECR all still apply.
This article is analysis of published sources as at 2 October 2026. It is not legal advice and does not say whether any particular organisation is or is not compliant.
Sources
All sources were opened and checked on 2 October 2026. Corrections are handled as set out in the editorial standards.
- Data (Use and Access) Act 2025, contents (legislation.gov.uk)
https://www.legislation.gov.uk/ukpga/2025/18/contents - Data (Use and Access) Act 2025, section 103: complaints by data subjects (legislation.gov.uk)
https://www.legislation.gov.uk/ukpga/2025/18/section/103 - Data (Use and Access) Act 2025: plans for commencement (GOV.UK, DSIT, updated 5 February 2026)
https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement - Data (Use and Access) Act 2025 (ICO)
https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/ - The Data Use and Access Act 2025: what does it mean for organisations? (ICO)
https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ - UK organisations stand to benefit from new data protection laws (ICO, June 2025)
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/uk-organisations-stand-to-benefit-from-new-data-protection-laws/ - Statement on the commencement of the Data (Use and Access) Act (ICO, 5 February 2026)
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statement-on-the-commencement-of-the-data-use-and-access-act-duaa/ - New data protection complaints law now in force (ICO, June 2026)
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/new-data-protection-complaints-law-now-in-force/ - One year on: marking the 12-month commencement of the Data (Use and Access) Act (ICO, June 2026)
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/one-year-on-marking-the-12-month-commencement-of-the-data-use-and-access-act/ - How to deal with data protection complaints (ICO guidance)
https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ - How do we prepare to handle data protection complaints? (ICO guidance)
https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-do-we-prepare-to-handle-data-protection-complaints/ - What do we do when we receive a complaint? (ICO guidance)
https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/what-do-we-do-when-we-receive-a-complaint/ - Final storage and access technologies guidance published (ICO, April 2026)
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/ - Storage and access technologies: what are the exceptions? (ICO guidance)
https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/