How we will regulate as the Data (Use and Access) Act commences
Latest updates - 05 February 2026
05 February 2026 - updated to reflect the consultation on the draft procedural guidance, which explains how we intend to use our new powers
19 June 2025 - This page was published
The Data (Use and Access) Act (DUAA) received Royal Assent on 19 June 2025 and will come into effect in phases.
We will continue to regulate the DPA 2018, UK GDPR and PECR, which stay in force, but will be amended by the DUAA. Organisations should follow the existing law until various parts of the DUAA are expected to commence at two, six and 12 months after Royal Assent.
We want to provide reassurance to businesses about how the changes impact our regulatory action.
It’s important to understand that we apply the law as it stands at the time an infringement took place, rather than the date that we received any complaint or report or when the infringement was detected.
In some cases, we will need to exercise our discretion when considering regulatory action on alleged non-compliance with an existing provision under the data protection legislation which is going to be removed, amended or replaced with a similar provision under the DUAA. We will make a judgement on whether to proceed with regulatory action under the old provision or, where there is ongoing non-compliance, consider action under the new provisions.
When considering regulatory action on the DUAA’s new provisions, we will consider the ICO guidance available to organisations at the time of the alleged non-compliance.
The DUAA provides us with new powers, including the power to:
- compel a witness to attend an interview;
- request technical reports; and
- issue fines of up to £17.5m or 4% of global turnover under PECR.
We have consulted on our new draft procedural guidance about the process we follow when carrying out investigations and taking enforcement action. This includes the DUAA provisions that amend and add to our existing powers. We will be publishing the final guidance in due course.
The DUAA brings in some new requirements for organisations. We will be publishing new and updated guidance to reflect these changes. Our planned guidance pages will set out when to expect new and draft guidance to give organisations certainty.
All website guidance pages relevant to DUAA changes will explain that the law is changing and where to find out more information.