UK Data Protection Compliance 2026: Navigating the New DUAA Framework

The Data (Use and Access) Act 2025, DUAA for short, is the biggest change to UK data protection law since UK GDPR itself. It doesn't replace GDPR, it amends it, easing some administrative burdens while sharpening accountability elsewhere. Most of its core provisions came into force on 5 February 2026. Here's what actually changed and what it means practically.

Table

Recognised Legitimate Interests

This is genuinely one of the more useful changes. Previously, relying on 'legitimate interests' as your lawful basis meant running a full balancing test every time. Now, a specific, limited list of purposes, crime prevention, safeguarding, responding to emergencies, national security, is pre-approved without that test. It only covers those specific purposes though, direct marketing and general business activities still need the traditional balancing assessment.

Automated Decision-Making Gets More Flexible

The old, fairly strict prohibition on significant automated decisions now only applies specifically when special category data is involved. For general personal data, organisations can rely on a broader range of lawful bases for AI-driven decisions, CV screening, credit scoring, that sort of thing, provided real safeguards are in place:

  • Clear information about how the decision was actually reached
  • A genuine route for human review, not just a token sign-off
  • A way for the individual to contest the outcome

Subject Access Requests Got More Manageable

  • 'Stop the clock': organisations can now pause the one-month SAR deadline while waiting on clarification or ID verification from the requester, genuinely useful for the more ambiguous requests
  • Reasonable and proportionate searches: you're no longer expected to conduct an exhaustive search across every legacy system, just a genuinely reasonable one

International Data Transfers

The DUAA replaces the old 'essentially equivalent' standard with a somewhat less demanding 'not materially lower' test for assessing whether data can move to another country. In practice, this hasn't triggered a wave of new approved destinations yet, but it's worth watching if your organisation moves data internationally. You'll still need to run a proper transfer risk assessment.

The Regulator Itself Is Changing

The ICO is being restructured into the Information Commission, a corporate body with a chair and board rather than a single Commissioner. It's been given real extra powers too, compelling witnesses to interview, requesting technical reports, and issuing considerably higher fines for PECR breaches specifically, up to £17.5 million or 4% of global turnover, aligned with the higher UK GDPR penalty tier rather than the old, much lower PECR cap.

A Practical Checklist

  1. Update your privacy notices to reflect the new recognised legitimate interests basis and any changes to your automated decision-making processes
  2. Set up a formal complaints process: from 19 June 2026, organisations must acknowledge data protection complaints within 30 days and investigate without undue delay, before it escalates to the Information Commission
  3. Review your cookie practices: some categories, mainly statistical and analytics cookies, no longer require prior consent under the DUAA's changes to PECR, but marketing cookies still do
  4. Update your SAR procedures to formally incorporate the stop-the-clock mechanism and the reasonable-and-proportionate search standard

A Few Honest Answers

Does this mean we can ignore EU GDPR? No. If you serve customers in the EEA, EU GDPR still applies to you regardless of what's changed domestically, you're complying with both regimes, not choosing between them.

Are fines actually going up? Specifically for PECR breaches, nuisance calls, spam, tracking without consent, yes, considerably, from a much lower historic cap to the same tier as UK GDPR.

The Bottom Line

The DUAA genuinely eases some administrative friction, fewer balancing tests, a pauseable SAR clock, more workable ADM rules, but it pairs that with real teeth: a restructured regulator and considerably higher PECR fines. Update your documentation and processes now rather than waiting for an enforcement action to prompt it.

Go up