UK GDPR after the Data (Use and Access) Act 2025: what changed

The Data (Use and Access) Act 2025 is the biggest reform of UK data protection law since Brexit. It received Royal Assent on 19 June 2025. It does not replace the UK GDPR: it amends it, along with the Data Protection Act 2018 and PECR, the regulations on cookies and marketing messages. Its changes came into force in stages, and as of 19 October 2026, every change described below applies.

For a small team, the question is what to change on your website and in your routines. Most of the Act makes life easier, one part adds a duty (complaints) and one raises the stakes (PECR fines). If you are new to the subject, my GDPR guide for small teams covers the basics first.

This article explains the law and the official guidance; it is not legal advice.

When the Data (Use and Access) Act 2025 changes took effect

Most of the February changes came from one statutory instrument, the Commencement No. 6 Regulations (SI 2026/82), which also set the 19 June 2026 start for complaints. The government’s commencement page lists every stage, and the text of the Act is on legislation.gov.uk.

Cookies: analytics without a banner, on conditions

PECR regulation 6 still requires consent before you store or read anything on a visitor’s device, unless an exception applies. Since 5 February 2026, the list of exceptions has three new entries, which the ICO’s guidance explains:

• Statistical purposes: analytics used only to produce statistics about how people use your site, so you can improve it. You may share the data with a third party only so that it can help you make those improvements.
• Appearance: remembering how a visitor wants the site to look or work, such as their language or text size.
• Emergency assistance: locating a device to send help in an emergency.

For the first two, you must give clear and comprehensive information and an easy way to object, for example a paragraph in your cookie policy with an opt-out link. If the same analytics data also feeds advertising, such as remarketing audiences, or tracks individual visitors, the exception no longer applies. Advertising cookies still need consent.

The result: a UK site with only strictly necessary cookies, statistics-only analytics and preference cookies can drop its consent banner, provided it informs visitors and offers the opt-out. My article on cookie banner rules compares the UK, EU and French regimes; the EU section below explains why many UK sites will keep a banner anyway.

Subject access requests: proportionate searches and a clock that can stop

Two changes make access requests easier to handle without weakening the right itself.

• Reasonable and proportionate searches (since 19 June 2025). You do not have to comb every backup and archived mailbox, but you do have to search where the data is likely to be and be able to explain where you stopped.
• Stop the clock (since 5 February 2026). A new Article 12A of the UK GDPR sets out the time limit and lets you pause it while you wait for a clarification you genuinely need, for example which period or which project the request is about.

What has not changed: the one-month deadline, the possible two-month extension for complex or numerous requests, and the grounds for refusing or charging, which remain “manifestly unfounded or excessive”. A broader “vexatious” test, proposed in an earlier bill, did not make it into the Act. My guide to answering a subject access request within one month has the full process.

Complaints: a new duty since 19 June 2026

This is the change that asks something of every organisation. Section 103 of the Act added section 164A to the Data Protection Act 2018: people can now complain to you directly about how you use their data, and you must:

1. make it easy to complain, for example with an online form;
2. acknowledge the complaint within 30 days, counted from the day after you receive it;
3. look into it without undue delay, keep the person informed and tell them the outcome.

The ICO’s guidance, “How to deal with data protection complaints” (12 February 2026), lets you choose your channels but says you must accept a complaint however it arrives, including through any member of staff. Your privacy notice should also tell people how to complain to you: my guide to what a privacy policy must say shows where it fits.

Legitimate interests, marketing and higher PECR fines

The Act adds a seventh lawful basis to Article 6 of the UK GDPR: recognised legitimate interests (Article 6(1)(ea)). For the purposes listed in its new Annex 1, such as crime prevention, safeguarding vulnerable people, emergencies and answering requests from public bodies, you no longer have to weigh your interests against the person’s. The processing must still be necessary, and your privacy information should say which condition you rely on. The ICO published its guidance on 23 March 2026. For most small teams, these situations are rare.

The change you are more likely to use is a clarification: the UK GDPR now names direct marketing, sharing data within a group of companies for internal administration, and keeping networks and systems secure as examples of processing that can be a legitimate interest. It is a signal, not a free pass. You still need a legitimate interests assessment, and anyone can object to direct marketing at any time, which ends it.

PECR, which decides whether you may send a marketing email at all, keeps its basic rules: limited companies can be emailed without consent, while sole traders, some partnerships and individuals need consent or the soft opt-in. What changed is the cost of getting it wrong. Since February 2026, the maximum PECR fine is £17.5 million or 4% of worldwide annual turnover, whichever is higher, against £500,000 before. My cold email compliance checklist covers both sets of rules, and charities will find their new soft opt-in in my guide to newsletter consent.

Automated decisions and international transfers

If software makes decisions about people without a human involved, such as screening out job applicants, the rules are now looser. Section 80 of the Act replaced Article 22 of the UK GDPR with Articles 22A to 22D, in force since 5 February 2026. Significant decisions based solely on automated processing are allowed with safeguards: you tell people about such decisions, let them make representations, offer human intervention and let them contest the outcome. Decisions using special category data, such as health or ethnic origin, remain tightly restricted.

For transfers out of the UK, a new “data protection test” asks whether protection after the transfer is “not materially lower” than in the UK, replacing the EU standard of “essentially equivalent”. Transfers already covered by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU clauses remain valid, so there is nothing to redo.

Customers in the EU: EU rules still apply

None of this changes the EU GDPR. If you offer goods or services to people in the EU, or monitor their behaviour, for example with advertising cookies, the EU GDPR applies to that processing under its Article 3(2), wherever your company is based. Take a Bristol online shop that ships to France and Ireland: the UK GDPR covers all its customers, and the EU GDPR applies as well to those in France and Ireland. The reverse holds too: a company in Paris or Dublin that sells to people in the UK falls under the UK GDPR for those customers.

Two practical consequences for a UK business:

• Cookies: the EU has no general exception for analytics. In France, the CNIL exempts only tools that meet strict conditions, so for EU visitors, keep asking consent for analytics unless your set-up meets the local rules. One banner for everyone is the simplest option.
• Representation: without an establishment in the EU, you will usually need an EU representative. My guide to when GDPR applies outside the EU sets out the two tests and the exemption.

Data still flows freely from the EU to you. After reviewing the Act, the European Commission renewed its adequacy decisions for the UK in December 2025, so EU clients and suppliers can keep sending you personal data without standard contractual clauses.

What to update now: a checklist for small teams

1. Cookies. List what your site sets, and rely on the new exceptions only if you do not target visitors in the EU.
2. Privacy notice. Add how to complain to you, name any recognised legitimate interest you rely on, and update the cookie section. The ICO’s free privacy notice generator was updated in 2026 for the Act.
3. Complaints. Choose a channel, name who handles complaints, and log the dates of receipt, acknowledgement and outcome.
4. Access requests. Write down where you search (inbox, CRM, invoicing tool, shared drive) so you can show your search was reasonable and proportionate.
5. Marketing. Refresh your legitimate interests assessment for prospecting, check PECR for each audience and keep a suppression list.
6. Automated decisions. List any tool, AI included, that decides about people without a human, then add the safeguards.

Most of these steps are small. When I build a site, the cookie set-up and the privacy pages are part of the website project. If you make automated decisions about people, handle health or other sensitive data, or process personal data on a large scale, a data protection lawyer or a DPO is worth the fee.