The Data (Use and Access) Act 2025 is the biggest UK data protection reform since GDPR, and it is now largely in force. Most of the data protection changes commenced on 5 February 2026, and the requirement with the widest practical reach, a dedicated data protection complaints procedure, followed on 19 June 2026.
Keith Markham works through what actually changed, provision by provision. The DUAA amends rather than replaces, so the session is framed around the UK GDPR, the Privacy and Electronic Communications Regulations 2003 and the Data Protection Act 2018 as they now read, with the amended text set out and the new wording marked.
Coverage runs from the new recognised legitimate interests basis, and why it is of limited use to the private sector, through the easing of the Article 14 privacy statement obligation, the codification of reasonable and proportionate searches for subject access requests, and the rewritten Article 22 on automated decision making. It then turns to PECR: the new cookie exceptions for statistical purposes and website appearance, what they do and do not permit for analytics, and the equalisation of fining powers with the UK GDPR tiers. The session closes on the section 164A complaints duty, the reform of the ICO's governance, and the new interview notice power.
Key Takeaways
- Why recognised legitimate interests is a public sector tool in practice, and how it compares with ordinary legitimate interests on the balancing test, necessity and the right to object
- What reasonable and proportionate search changes for subject access requests, and why it largely codifies what the ICO has said for a decade
- How the rewrite of Article 22 narrows the conditions to special category data while extending the safeguards to all personal data
- Which analytics cookies can now be placed without consent under the statistical purposes and website appearance exceptions, and which still cannot
- Why PECR penalties have moved from a 500,000 pound cap to the UK GDPR tiers for breaches on or after 5 February 2026
- The four steps of the section 164A complaints duty, including the 30 day acknowledgement and the without undue delay obligations that follow it
Recorded Webinar
18384 Users
1688 Courses
984 Reviews