Your 2026 UK Privacy Checklist and the Data (Use and Access) Act

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and has been brought into force in stages. By October 2026, almost all of its data protection and privacy changes apply. It amends UK GDPR, the Data Protection Act 2018 and PECR (the rules on cookies and electronic marketing) rather than replacing them, so the fundamentals you already follow still stand.

Below is what has changed, when, and a checklist to work through.

What has commenced, and when

According to the government’s commencement plan and the ICO:

• 20 August 2025: technical provisions and new statutory objectives for the ICO.
• 5 February 2026: the majority of the data protection and privacy changes, including the changes to UK GDPR and PECR described below.
• 19 June 2026: the new duty to handle data protection complaints.
• 30 September 2026: the Information Commissioner’s Office became the Information Commission, led by a board rather than a single commissioner. Its role, powers and guidance didn’t change.

Some parts of the Act that aren’t about data protection, such as the National Underground Asset Register and electronic registration of births and deaths, have their own longer timetables.

The changes most likely to affect a small business

A legal duty to handle complaints

Since 19 June 2026, every organisation must give people a way to complain about how it uses their personal data, acknowledge each complaint within 30 days, look into it and respond without undue delay, and tell the person the outcome. The ICO suggests steps such as an electronic complaints form. People are now expected to complain to you first, before going to the regulator.

Some cookies no longer need consent

You can now set some cookies without consent, including those used only to collect statistics about how your own website is used and those used to improve its appearance or functions. There are conditions: you must give clear information about them and an easy way to object, and the cookie must be used only for that purpose. Advertising and cross-site tracking still need consent.

Higher fines for cookie and marketing breaches

The regulator can now fine up to £17.5 million or 4% of global turnover under PECR, the same level as UK GDPR. Unsolicited marketing emails, texts and calls, and cookies set without a lawful basis, now carry much bigger risks.

Subject access requests: reasonable and proportionate searches

The Act confirms that when someone asks for a copy of their data, you only need to make reasonable and proportionate searches. You still have to respond fully and on time, so you need to know where personal data is kept, including email, Teams and file shares.

A new lawful basis: recognised legitimate interests

For a short list of purposes, such as crime prevention, safeguarding, emergencies and public security, you can rely on “recognised legitimate interests” without carrying out the usual balancing test.

More flexibility on automated decisions

Organisations can now make significant decisions about people using automated processing on a wider range of lawful bases, with safeguards: telling people, letting them challenge the decision and offering human review. The stricter rules still apply to special category data. If you use AI tools to screen job applicants or make decisions about clients, check what this means for you.

Children’s data

If your online service is likely to be used by children, you must now consider their needs explicitly when deciding how to use their data.

International transfers

The test for transfers abroad is now whether protection after the transfer is “not materially lower” than in the UK, called the “data protection test” in the Act. In December 2025 the European Commission renewed its adequacy decisions for the UK, so data can continue to flow from the EU. Our post on cloud compliance for UK businesses explains transfers and the UK-US data bridge.

Your 2026 privacy checklist

New for 2026

• Set up a complaints process. A form or dedicated email address, someone responsible, a 30-day acknowledgement and a record of each complaint and its outcome.
• Review your cookies. List what your website sets, move qualifying analytics and functionality cookies to the new exceptions if you wish, and make sure advertising cookies still wait for consent.
• Update your privacy notice to mention the complaints process and any change to cookies or lawful bases, and add a “last updated” date.
• Check marketing consents in light of the higher PECR fines.

The essentials that haven’t changed

• Know what you hold. Keep a record of what personal data you process, why, where it’s stored and who it’s shared with.
• Have a lawful basis for each use, and tell people about it in plain language.
• Keep it secure. Multi-factor authentication, encryption, updates, access based on role and tested backups. Cyber Essentials is a good baseline; try our Cyber Essentials checklist.
• Have contracts with your processors, including your IT provider and cloud services.
• Set retention periods and actually delete data when they expire.
• Be ready for a breach. Reportable personal data breaches must go to the regulator within 72 hours of becoming aware, where feasible.
• Train your staff, and keep a record that you did.

Our post on writing an IT compliance policy covers how to turn this into rules your team can follow.

Where to get help

The ICO’s guidance has been updated throughout 2026 and is the best primary source for the detail. For the technical side, such as security controls, finding where personal data is kept, and the evidence that shows you’ve done it, our page on IT support for regulated businesses explains how we help companies that have to prove they take data protection seriously.