In a fast-moving digital world, there is a careful balance to strike between innovation and compliance – and as the Data (Use and Access) Act 2025 brings with it an even tighter regulator landscape, businesses must tread carefully to ensure compliance.
Contributors: Charlotte Cunningham, Rheia Masih, and Lisa Sweetman.
On 5 February 2026, a number of reforms under the Act, which aim to support business innovation while maintaining strong personal data protections, came into force.
The Act constitutes the first substantive change to data protection law since GDPR came into force in 2018, and many businesses may not have reviewed their processing activities or updated internal policies since then. With the introduction of mandatory complaints procedures and additional ICO governance measures taking effect in June 2026, it is important for you to review and understand the requirements under the legislation to ensure you remain compliant.
How could the changes impact you?
The Act affects all UK organisations that process personal data – particularly those in the technology, finance, marketing and public sectors. Bringing in more flexible lawful bases for processing and clearer rules on data use, just some of the changes ushered in by the Act include:
- Updates to governance and Subject Access Request processes.
- Automated decision-making reviews.
- Stronger enforcement powers for the ICO, including compelling interviews and technical reports.
- Clearer rights and safeguards for individuals.
What steps should you take?
To ensure compliance, organisations should review their data policies, update their Subject Access Request processes, and prepare for the introduction of mandatory complaints procedures in readiness for 19 June 2026.
Key takeaways:
- Roll out training for your staff.
- Monitor ICO guidance and enforcement powers.
- Prepare your complaints procedure before 19 June 2026.
- Review your Subject Access Request and automated decision-making processes.
- Update your data protection policies.
Please be advised that this is an update which we think may be of general interest to our wider client base. The insights are not intended to be exhaustive or targeted at specific sectors as such, and whilst we naturally take every care in putting our articles together, they should not be considered a substitute for obtaining proper legal advice on key issues which your business may face.