The UK’s data protection landscape shifted again on 5 February 2026 with the arrival of a major implementation milestone under the Data (Use and Access) Act 2025 (DUAA). The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 are now in force, bringing with them the majority of changes related to data protection that DUAA sets out.
While this step was expected during the first half of 2026, the regulations have attracted surprisingly little attention and many organisations may not yet realise that DUAA’s principal data protection reforms are now live.
The Commencement No. 6 Regulations bring changes to cookies rules (allowing use of a wider range of cookies without needing consent), automated decision making (making it available to use in a wider range of settings), ICO enforcement powers and new recognised legitimate interests grounds for processing data (and many other changes not listed here). The changes relating to having in place a mandatory regime to handle complaints by data subjects don’t come into force until 19 June 2026 and the changes to ICO governance will be later still.
We don’t yet have all of the guidance relating to these changes from the ICO and this is a moving feast. The ICO has suggested that it will take a measured approach to enforcement during the transition period — particularly for areas where guidance is not yet finalised. More detail is available in the ICO’s enforcement statement.
The bottom line is that the changes are now live. Businesses should stay alert as further ICO guidance emerges throughout Spring and Summer 2026. Compliance with the DUAA changes will be an ongoing transition throughout 2026 but they open up new opportunities for businesses. Our article about the Commencement No. 6 Regulations, and our earlier article about DUAA, tell you more about the changes and practical steps you can be taking to prepare.
Please get in touch with me (Sheilah) or Victoria Ferguson if you’d like any more information.