The Data (Use and Access) Act 2025
Is Now Law — Here’s What Changes
The UK’s most significant data protection reform since GDPR came into force on 5 February 2026. Three obligations are already live. One hard deadline is coming fast.
A Reform, Not a Revolution
The Data (Use and Access) Act 2025 is the UK’s most substantial update to data protection law since the original implementation of the GDPR. Importantly, it amends but does not replace the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). The underlying framework stays intact — but several significant rules change.
🔑 The DUAA’s stated purpose is to strike a new balance: promoting innovation and economic growth while maintaining robust protections for individuals. For DPOs, this means new flexibilities in some areas — and new hard obligations in others.
What the DUAA Actually Changes
The DUAA introduces changes across six major areas. Some are permissive — giving organisations more flexibility. Others create new compliance obligations. Here’s what every DPO needs to understand.
The ICO Has New Teeth
The DUAA significantly strengthens the ICO’s investigatory and enforcement arsenal. These changes are already in force as of 5 February 2026. Organisations should update their internal incident response plans accordingly.
🏛️ ICO’s Expanded Powers — In Force Now
Sections 96–101 DUAA · Effective 5 February 2026
-
Information Notices — Document ProductionExisting power clarified to explicitly include the production of documents. The ICO can now formally compel organisations to hand over records, files, and evidence as part of an investigation.
-
Assessment Notices — Commissioned ReportsNew power to require organisations to commission and pay for an independent forensic or technical report to assist the ICO’s investigation. The organisation bears the cost.
-
Interview Notices — Compelled WitnessesEntirely new power. The ICO can require named individuals to attend a formal interview and answer questions under investigation. Non-compliance increases penalties and can result in prosecution.
-
Tightened Penalty TimelinesFinal penalty notices must now be issued within 6 months of a notice of intent, or as soon as reasonably practicable. The ICO must also formally notify if it decides not to impose a penalty.
Separately, the DUAA restructures the ICO itself. The organisation will be renamed the Information Commission — Paul Arnold was appointed its first CEO in June 2025. All internal documentation referencing “the ICO” as a legal entity should begin tracking this transition.
Building Your Complaints Procedure — Before 19 June 2026
This is the most operationally complex new obligation. Under Section 103 DUAA (inserting Section 164A into the DPA 2018), every data controller must have a formal complaints procedure in place. The ICO’s draft guidance proposes outcomes be provided within 3 months in normal circumstances.
📋 What the Procedure Must Include
Based on ICO guidance and Mayer Brown analysis of Section 103 DUAA requirements
- Accessible submission channels — An electronic complaints form is mandatory. Alternative routes (email, post) must also be available. The process must be open to anyone, not just customers or employees.
- Prominent placement — The complaints process must be easy to find: prominently linked from your privacy notice, website footer, and any relevant service pages.
- 30-day acknowledgement — All complaints must be acknowledged within 30 calendar days of receipt. This is a hard requirement, not a target.
- Meaningful investigation — You must take “appropriate steps without undue delay”, make reasonable enquiries, and keep the complainant informed of progress throughout.
- Plain-language outcome — Final decisions must be communicated clearly, in accessible language, within ~3 months (ICO draft guidance). Individuals must be told of their right to escalate to the ICO.
- Documented governance — Maintain a central complaint log tracking: receipt date, actions taken, outcome, and escalation history. Report regularly to senior management.
- Staff training — Train all customer-facing, HR, IT, and operations staff to recognise and correctly escalate data protection complaints.
🔄 UK vs EU — Key Divergence Points
| Area | 🇬🇧 UK (Post-DUAA) | 🇪🇺 EU (GDPR) |
|---|---|---|
| Lawful Basis | New “Recognised Legitimate Interest” for pre-approved purposes | Standard 6 bases — no pre-approved shortcuts |
| Complaints | Controller-first mandatory step before ICO escalation | Data subjects can go direct to DPA |
| Transfers | New TRA framework replaces TIA — reworded adequacy test | SCCs + TIA remain the standard mechanism |
| Auto. Decisions | Replaces Article 22 — broader permissions + new safeguards | Article 22 prohibitions remain strict |
| Research re-use | Notice exemption if disproportionate effort | Generally requires individual notification |
Three Things to Do Now
Need Help Building Your DUAA Compliance Programme?
DPO Advisors can assess your current posture against the DUAA requirements, draft your complaints procedure, and prepare your team for the new ICO enforcement landscape — fast.
Talk to our experts →