Somebody in your organisation has probably heard that data protection law has changed, and is wondering whether the privacy notice, the cookie banner or the way you answer a request for someone’s data needs rewriting. The honest answer is that some things did change, most of them don’t force a specific change, and one new duty was still on its way in mid-March 2026. Nothing here is legal advice. It’s a plain-English account of what the law and the Information Commissioner’s Office (ICO) say, so you know what to look at and when to ask a professional.
It amends the law you already follow
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It doesn’t replace UK GDPR, the Data Protection Act 2018 or the Privacy and Electronic Communications Regulations (PECR), which is the law on cookies and electronic marketing. It amends them. The ICO’s own summary says most of the changes offer you an opportunity to do things differently rather than requiring a specific change, so if you already handle personal data sensibly you aren’t starting again. If you want the basics, we covered them in our earlier piece on data privacy basics.
The changes came in stages, and the staging is what trips people up, because each provision takes effect on its own date.
| When | What took effect |
|---|---|
| June to August 2025 | Some provisions on Royal Assent, then the first, mostly technical commencement regulations (20 August). More regulations followed before the end of 2025 |
| 5 February 2026 | The main data protection and PECR changes |
| 19 June 2026 (planned) | The duty to have a complaints process |
The middle row comes from the regulations that brought most of Part 5 into force, made on 29 January 2026, and the same regulations set the last row. The government’s published commencement plan puts the complaints duty among the measures needing a longer lead-in, expected about 12 months after Royal Assent.
Subject access requests are the change you’re most likely to meet
Anyone can ask what you hold about them, which is why this is the change most organisations are likely to meet first. When someone does, the response clock starts from the last of three things: receiving the request, receiving any identity information you asked for and receiving any fee. You get one month from that point. The clock pauses while you wait for information you reasonably need to find the data, and you can extend by two months for complex or numerous requests, as long as you tell the person, with reasons, before the month is up.
What you owe is tied to a reasonable and proportionate search, not an unlimited one. That wording is treated as having applied since 1 January 2024, so it covers requests that were already in progress when the Act passed. A request you received before 5 February 2026 stays on the old time limits, though.
The ICO’s individual rights guidance carried a note that it was under review following the Act, so expect its wording to move. Meanwhile we’d write down how you decide what a reasonable search is, and keep a short record of what you searched and why. That record is what you’d want to hand over if anyone later questions whether you looked hard enough.
Cookies, marketing and the size of the fine
For websites, the Act adds exceptions to the consent rule for cookies and similar technologies. Two are likely to matter to you: collecting statistics to improve your own site, and adapting how a site looks or works to a visitor’s preferences. Neither is a free pass. Schedule 12 ties each to a sole purpose, clear information for the visitor and a simple, free way to object, and anything outside the exceptions still needs consent. An analytics tool whose data is shared for purposes other than improving the site wouldn’t fit the statistics exception, for example.
Marketing carries a heavier consequence. From 5 February 2026 the ICO’s new powers include fines of up to £17.5 million or 4% of global turnover, whichever is higher, under PECR. The regulations apply that to breaches on or after that date, and the ICO has said it applies the law as it stood when an infringement took place.
Charities also gained a soft opt-in for electronic mail marketing. It covers people whose details the charity collected while they were expressing an interest in its purposes, or offering or providing support for them, where the marketing solely furthers those purposes and the person was given a simple, free way to refuse, both when their details were collected and in every later message.
Lawful bases, automated decisions and transfers
Three other changes are real but narrower. A lawful basis is the legal reason you’re allowed to use personal data, and there’s a new one called recognised legitimate interests. It covers a closed list of purposes such as crime prevention, safeguarding and emergencies, and it removes the balancing test, which is the step where you weigh your interests against the person’s. The use of the data still has to be necessary for the purpose.
Automated decisions are the second. These are decisions with significant effects on a person that a system makes without human involvement, and the rules were rewritten so that more lawful bases can be used, provided safeguards are in place, including a way for people to contest the decision. In some cases the freedom is narrower. Special category data (the more sensitive kinds, such as health information) is restricted, and a fully automated significant decision can’t rest on recognised legitimate interests.
The third is the test for sending personal data outside the UK, which was reworded. That’s a question for whoever drafted your transfer paperwork rather than something to change yourself.
The one still to come: complaints
From 19 June 2026 you’ll need a process for handling data protection complaints, with no exemptions. The ICO’s guidance, published on 12 February 2026, says you must give people a way to complain, acknowledge within 30 days, respond without undue delay and tell them the outcome. The duty applies to complaints you receive on or after that date, and the ICO describes the guidance as good practice already.
That makes it the sensible place to start, because for most organisations it’s the one new change that obliges you to put a process in place. The ICO lists a second new requirement, for online services likely to be used by children, which took effect on 5 February 2026.
What we’d look at, and when to take advice
We’d begin with the practical routines rather than the policy documents. Does anyone know who picks up a subject access request, and how they’d find the data across email, shared drives and cloud services? Does your website still run cookies that the banner doesn’t mention? Is there a place a customer could send a complaint, and a name against it? For a small organisation, a named person and a one-page note on each of those is a reasonable starting point. A larger one, with data spread across many systems or several departments answering requests, needs the process written down and tested. These are questions about systems and habits, and they’re what we’d go through when preparing for a data protection assessment, alongside where your data lives and who can reach it.
For anything that turns on how the law applies to your circumstances, such as a disputed access request, automated decisions about people, transfers abroad or a possible breach of the marketing rules, take advice from a data protection lawyer or a qualified adviser. We’re not a law firm, and this is not legal advice.
If you’d like a second pair of eyes on whether your routines for access requests, cookies and complaints would be ready for an assessment before the complaints duty arrives, get in touch and we’ll see what makes sense.
