UK Data Privacy Laws: UK GDPR, DPA 2018 & 2025 Reforms

The United Kingdom's data privacy framework is built on the UK GDPR and the Data Protection Act 2018, both enforced by the ICO (the Information Commission from 30 September 2026, which continues to be known as the ICO). The Data (Use and Access) Act 2025 amended both instruments, with core changes in force from 5 February 2026.

The United Kingdom operates one of the world's most developed data privacy regimes. Built on the Data Protection Act 2018 and the retained UK General Data Protection Regulation (UK GDPR), the framework provides strong rights for individuals and significant compliance obligations for organisations.

Since Brexit, the UK has maintained its own independent data protection regime, separate from the EU GDPR, enforced domestically by the ICO (the Information Commission from 30 September 2026, which continues to be known as the ICO). In 2025, the UK Parliament enacted the Data (Use and Access) Act 2025 (DUAA), the most significant overhaul of UK data law since the DPA 2018, introducing targeted reforms to how businesses, public bodies, and researchers handle personal information.

This guide covers the full UK data privacy framework as it stands in 2026: the legal foundations, the DUAA's specific reforms and phased commencement, the renewed EU adequacy decision, lawful bases, data subject rights, enforcement, and practical compliance steps for organisations.

This article presents general legal information about UK data protection law. It does not constitute legal advice. For guidance specific to your situation, consult a solicitor or data protection professional qualified to advise in England and Wales (or Scotland or Northern Ireland as applicable). Information verified as of 30 September 2026.

Quick Answer: What Are the UK's Data Privacy Laws?

The UK's data privacy framework rests on three interlocking instruments. The UK GDPR is the primary regulation, retained from EU law via the European Union (Withdrawal) Act 2018 and setting out core principles, lawful bases, individual rights, and accountability requirements. The Data Protection Act 2018 supplements the UK GDPR with domestic implementation provisions, exemptions, and separate regimes for law enforcement and intelligence services. The Data (Use and Access) Act 2025, which has been brought into force in stages since Royal Assent on 19 June 2025 (most data protection changes from 5 February 2026), amends both earlier instruments with targeted reforms including new lawful-basis categories, modified automated decision-making rules, expanded cookie consent exemptions, and a restructured ICO. The ICO is the independent supervisory authority responsible for enforcing all three instruments and can impose fines up to GBP 17.5 million or 4% of global annual turnover. For cross-border flows, the EU renewed its UK adequacy decisions in December 2025, extending them to 27 December 2031.

The UK GDPR and Data Protection Act 2018

The foundational two-instrument structure has been in place since 1 January 2021, when the UK left the EU's data protection framework.

UK GDPR: Retained EU Law

When the UK left the European Union on 31 January 2020, Parliament incorporated the EU GDPR into domestic law through the European Union (Withdrawal) Act 2018. This retained version, known as the UK GDPR, preserves the same structure and principles as the EU regulation but operates as a standalone piece of UK legislation interpreted by UK courts.

The UK GDPR applies to any organisation that processes the personal data of individuals in the UK, regardless of where that organisation is based. This extraterritorial reach means a company in the United States, Canada, or anywhere else must comply with UK GDPR if it offers goods or services to UK residents or monitors their behaviour.

Data Protection Act 2018

The Data Protection Act 2018 received Royal Assent on 23 May 2018 and provides the detailed domestic implementation framework for the UK GDPR. It includes provisions that the UK GDPR delegates to member states, such as exemptions for journalism, research, and statistical purposes, and additional conditions for processing sensitive data.

The DPA 2018 also contains separate frameworks for law enforcement processing (Part 3, implementing the Law Enforcement Directive) and intelligence services processing (Part 4), each with their own distinct requirements.

The Seven Data Protection Principles

The UK GDPR establishes seven fundamental principles that underpin all data processing activities. These are legally binding requirements. Infringing them attracts the highest tier of fines.

Personal data must be:

1. Processed lawfully, fairly, and transparently in relation to the data subject
2. Collected for specified, explicit, and legitimate purposes and not further processed incompatibly with those purposes
3. Adequate, relevant, and limited to what is necessary (data minimisation)
4. Accurate and kept up to date, with inaccurate data corrected or erased without delay
5. Kept in identifiable form no longer than necessary for the processing purpose
6. Processed with appropriate security, protecting against unauthorised or unlawful processing and accidental loss, destruction, or damage
7. Subject to accountability, requiring the controller to demonstrate compliance with all other principles

Lawful Bases for Processing Personal Data

Before processing any personal data, organisations must identify and document a lawful basis under Article 6 of the UK GDPR. There are six available bases.

The Six Lawful Bases

Organisations must determine their lawful basis before processing begins and cannot change it retroactively. They must communicate it in privacy notices.

Special Category Data

Article 9 of the UK GDPR places additional restrictions on processing sensitive personal data, including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric identification data, health data, and data concerning sex life or sexual orientation.

Processing special category data requires both a lawful basis under Article 6 and a separate condition under Article 9. DPA 2018 Schedule 1 provides 23 substantial public interest conditions that may supply that additional condition.

The Data (Use and Access) Act 2025: What It Changes

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is the most significant reform to UK data protection since the DPA 2018. It amends the UK GDPR, the DPA 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), and creates new frameworks for smart data portability and digital verification services.

The Act was the successor to the Data Protection and Digital Information (DPDI) Bill, which fell when the 2024 general election was called. The Labour government restarted the process and steered the DUAA to Royal Assent.

Recognised Legitimate Interests

The DUAA introduces a new lawful basis, "recognised legitimate interests", in Article 6(1)(ea) of the UK GDPR, with the qualifying conditions listed in Annex 1. For these specified purposes, organisations do not need to conduct the third step of the usual legitimate interests assessment (the balancing test) because Parliament has already determined that the legitimate interest outweighs data subjects' rights in these contexts.

The five recognised legitimate interests are processing necessary for:

1. National security, public security, or defence (including activities to safeguard state security)
2. Preventing, detecting, investigating, or prosecuting criminal offences, or executing criminal penalties
3. Safeguarding vulnerable individuals, particularly children
4. Responding to emergencies under the Civil Contingencies Act 2004 that threaten life, health, or safety
5. Assisting public bodies in performing their statutory tasks, where the sharing controller has received a lawful request from the public body

Organisations relying on a recognised legitimate interest must still satisfy the purpose-limitation and necessity tests; only the balancing test step is removed. Activities such as direct marketing, intra-group transmission of personal data for internal administrative purposes, and network security are listed in Article 6(11) only as examples of ordinary "legitimate interests"; they do not fall within the recognised category and still require a full three-part assessment. The ICO published guidance on recognised legitimate interests in early 2026.

Automated Decision-Making: Reformed Rules

The DUAA creates a more permissive framework for automated decision-making under the amended Article 22 of the UK GDPR. Under the original UK GDPR, solely automated decisions with legal or similarly significant effects were generally prohibited unless one of three narrow conditions applied (consent, contractual necessity, or authorised by law).

Under the DUAA amendments, organisations can make such decisions in broader circumstances, but must implement mandatory safeguards:

• Providing data subjects with meaningful information about significant decisions made about them
• Enabling individuals to make representations and contest decisions
• Ensuring human intervention is available upon request
• Reviewing challenged decisions with genuine human involvement

Two limits remain (Article 22B). A significant decision based entirely or partly on special category data may be solely automated only with the data subject's explicit consent, or where it is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies. And no significant decision may be taken solely by automated means where the processing relies on recognised legitimate interests (Article 6(1)(ea)).

The ICO has consulted on draft automated decision-making guidance updated for the DUAA (draft last updated 31 March 2026).

Subject Access Requests: Stop-the-Clock

The DUAA introduces a "stop-the-clock" mechanism for subject access requests (SARs). When an organisation requests further information from the data subject to locate the data or clarify the request, the one-calendar-month response period pauses until that information is received. This addresses a longstanding practical difficulty where organisations faced the same deadline regardless of whether the requester had provided necessary clarification.

Scientific Research Provisions

The DUAA clarifies that "scientific research" for UK GDPR purposes may include commercial research, a point previously uncertain. It also allows researchers to seek consent for broad areas of related research rather than a single, narrowly defined project, and sets out safeguards that must accompany research uses of personal data.

Complaints Process

Organisations must now provide an electronic mechanism for data subjects to make complaints. They must also inform individuals of the outcome of their complaint. These complaints provisions are already in force. Section 103 of the DUAA and Schedule 10 were commenced on 19 June 2026 by SI 2026/82, which inserted section 164A into the Data Protection Act 2018. Regulation 7 of that instrument limits the 30-day acknowledgement duty and the duty to respond and report the outcome to complaints received by the controller on or after 19 June 2026.

Children's Data Protection

New rules require online services likely to be accessed by children to consider how to protect and support children when designing those services. The ICO has also launched investigations into how social media and video-sharing platforms use UK children's personal information, with the Reddit and Imgur enforcement actions in 2026 marking the beginning of heightened enforcement in this area.

Smart Data and Digital Verification Services

Part 1 of the DUAA establishes a legislative framework for smart data schemes, enabling consumers to share their data with authorised third parties across sectors. Part 2 creates a statutory framework for digital verification services, including a trust register for certified providers, enabling streamlined identity verification. The digital identity provisions commenced on 1 December 2025.

The DUAA's Phased Commencement

The DUAA has been commenced in stages through separate statutory instruments. The key dates are:

The ICO's Transformation: Becoming the Information Commission

One of the most structurally significant changes in the DUAA is the abolition of the office of Information Commissioner, a corporation sole, and its replacement with a body corporate called the Information Commission.

Under the old model the regulator is a corporation sole, meaning legal authority is vested in the individual Information Commissioner. John Edwards, Information Commissioner from January 2022, resigned on 19 June 2026, and the ICO's board and executive team led the office under its scheme of delegation until the handover. The Information Commission is instead led by a board comprising a Chair, a CEO, and seven non-executive members with shared governance responsibility.

Paul Arnold has been appointed as the first CEO of the Information Commission on an interim basis for up to two years.

The transition date is now fixed. The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015 (C. 83), made on 10 September 2026, provide at regulation 2 that three provisions of the DUAA "come into force on 30th September 2026": section 117(4)(a), section 118 (abolition of the office of Information Commissioner) and section 119 (transfer of functions to the Information Commission).

Regulation 3 is the saving provision that keeps live work intact across the handover. It provides that any act, omission or other thing, "including legal proceedings", done or in the process of being done by or in relation to the Information Commissioner immediately before 30 September 2026 "is to be treated as an act, omission or thing done or in the process of being done, and capable of being continued, by or in relation to the Information Commission."

In practical terms, an open complaint, an ongoing investigation, a live penalty notice or a pending appeal does not restart on 30 September 2026. It continues in the Information Commission's name. Until that date the ICO continues to exercise all of its current powers, and organisations deal with the same regulator and the same processes either way.

The EU Adequacy Decision for the UK

After the UK left the EU's data protection framework, the European Commission needed to assess whether UK law continued to provide adequate protection before EU organisations could freely transfer personal data to the UK.

Original 2021 Adequacy Decisions and the 2025 Renewal

The Commission granted the UK adequacy in June 2021, adopting two decisions (one under the EU GDPR, one under the Law Enforcement Directive). The original decisions contained a four-year sunset, set to expire on 27 June 2025.

As that deadline approached, the Commission extended validity by six months while it assessed the impact of the Data (Use and Access) Act 2025 on UK data protection standards. Following that assessment, the Commission formally renewed both adequacy decisions on 19 December 2025, extending them until 27 December 2031.

This means organisations in EU and EEA member states can continue to transfer personal data to the UK without Standard Contractual Clauses or other Article 46 safeguards. The Commission confirmed that the DUAA's reforms did not lower UK data protection standards.

UK-to-EU Transfers

Data flowing from the UK to the EU/EEA does not require a separate adequacy decision. The UK has recognised EU/EEA member states as providing adequate protection under the UK's own adequacy regime.

Cookies and PECR: The New Consent Exemptions

The Privacy and Electronic Communications Regulations 2003 (PECR) govern cookies, electronic marketing, and communications metadata in the UK. The DUAA's Part 5 amendments to PECR, which came into force on 5 February 2026, made two major changes.

Expanded Cookie Consent Exemptions

Regulation 6(1) of PECR previously exempted only "strictly necessary" cookies from the requirement to obtain user consent. The DUAA moves the exceptions into a new Schedule A1 to PECR, under which consent is not needed for:

• Strictly necessary storage for a service the user requested, which now expressly includes protecting information, keeping the device secure, preventing or detecting fraud or technical faults, authenticating the user, and remembering their selections
• Statistical or analytics purposes: information collected solely to improve the service or website, and shared only with someone helping to make those improvements
• Website appearance and functionality: storage whose sole purpose is to adapt the site's appearance or functionality to the user's preferences, or otherwise enhance it
• Emergency assistance: storage or access whose sole purpose is to locate a user who has asked for emergency assistance or whose communication shows they need it

The analytics and appearance exemptions carry conditions: the user must be given clear and comprehensive information about the purpose and a simple, free means of objecting, and must not have objected.

Elevated PECR Fines

The DUAA aligns PECR enforcement with the UK GDPR fining regime. The previous maximum PECR fine was GBP 500,000. Under the DUAA, the ICO can now impose PECR fines of up to GBP 17.5 million or 4% of global annual turnover, whichever is higher, for the most serious PECR breaches.

The ICO finalised its guidance on storage and access technologies (cookies) on 29 April 2026, after consulting on draft versions.

Cross-Border Data Transfers

Transferring personal data outside the UK requires compliance with Chapter V of the UK GDPR. The primary mechanisms are:

UK Adequacy Regulations

The UK Secretary of State can make adequacy regulations recognising that a third country provides adequate data protection. When in place, data flows freely without additional safeguards. The UK recognises all EU/EEA member states and countries previously recognised under EU GDPR adequacy decisions at the time of the UK's departure.

UK International Data Transfer Agreement (IDTA)

For transfers to countries without UK adequacy, organisations can use the UK International Data Transfer Agreement (IDTA), a UK-specific contractual framework that replaced the EU Standard Contractual Clauses on 21 March 2022. Organisations may also use the UK Addendum to the EU SCCs as an alternative.

The DUAA introduces a new standard for the Secretary of State's adequacy assessments: whether the third country provides a level of data protection "not materially lower" than the UK standard, replacing the previous "essentially equivalent" test. The ICO has signalled plans to update the IDTA and Addendum in 2026 to reflect DUAA changes.

UK Extension to the EU-US Data Privacy Framework

The UK established its own extension to the EU-US Data Privacy Framework, enabling transfers to US organisations that self-certify to the UK extension scheme.

Data Subject Rights Under the UK GDPR

The UK GDPR grants individuals eight statutory rights over their personal data.

The Eight Rights

Responses are generally free. Organisations can charge a reasonable fee or refuse manifestly unfounded or excessive requests. The one-month deadline can be extended by a further two months for complex requests if the data subject is notified within the first month.

Breach Notification Requirements

Notifying the ICO

Under Article 33 of the UK GDPR, organisations must report a qualifying personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. This obligation applies when the breach is likely to result in a risk to the rights and freedoms of individuals.

Not every breach requires notification. Organisations must assess the likely risk and report only those breaches meeting the threshold. If reporting takes longer than 72 hours, reasons for the delay must be provided.

Notifying Affected Individuals

When a breach is likely to result in a high risk to the rights and freedoms of individuals, the organisation must also notify those individuals directly and without undue delay. The threshold for individual notification is higher than for ICO notification.

Phased reporting is permitted under Article 33(4). Where a full investigation cannot be completed within 72 hours, organisations may report initial information and follow up as the investigation progresses.

The ICO: Powers and Enforcement

The ICO is the UK's independent supervisory authority for data protection and information rights. It has broad powers under the DPA 2018 to issue information notices, assessment notices, enforcement notices, and penalty notices.

Penalty Structure

Notable ICO Enforcement Actions

Metropolitan Police Service (2026): On 5 August 2026, the ICO issued the Metropolitan Police Service an enforcement notice and a reprimand, not a fine, for failing to put in place appropriate technical and organisational measures to protect personal data, an infringement of section 40 of the Data Protection Act 2018 (the security duty for law-enforcement processing under Part 3). In one case an officer served unredacted stalking protection order documents that disclosed a victim's new address and phone number to the alleged stalker; in another, an officer placed 18 recipients' details in the "To" field of a group email. The ICO found systemic weaknesses in training and governance and required the force to complete remedial steps within three and twelve months.

British Airways (2020): The ICO fined British Airways GBP 20 million for a data breach affecting over 400,000 customers. Attackers harvested payment card details from the BA website in 2018. The ICO found BA had failed to implement appropriate security measures under Articles 5(1)(f) and 32 of the GDPR (as it applied in the UK before Brexit).

Marriott International (2020): Marriott received a GBP 18.4 million fine after a cyber-attack on the Starwood Hotels system compromised approximately 339 million guest records worldwide.

TikTok (2023): The ICO issued a GBP 12.7 million penalty against TikTok for misusing children's personal data, processing the data of children under 13 without appropriate parental consent. On 24 September 2026 the ICO announced that TikTok had withdrawn its appeal and agreed to pay the GBP 12.7 million fine.

Clearview AI (2022; jurisdiction confirmed 2025): The ICO fined Clearview AI GBP 7.5 million for unlawfully scraping images of UK residents to build a facial recognition database. In October 2025 the Upper Tribunal ruled that the ICO had jurisdiction to issue the penalty and sent Clearview's substantive appeal back to the First-tier Tribunal. Clearview has permission to appeal the Upper Tribunal's decision to the Court of Appeal.

Reddit (2026): On 24 February 2026, the ICO fined Reddit GBP 14.47 million for unlawful processing of children's personal information, including failing to apply robust age assurance measures and failing to conduct a DPIA before January 2025. This was the ICO's largest children's privacy fine to date.

Imgur/MediaLab.AI (2026): The ICO fined MediaLab.AI (owner of Imgur) GBP 247,590 in February 2026 for processing the data of children under 13 without parental consent or a lawful basis.

X and xAI (Grok) investigation (2026): On 3 February 2026 the ICO opened formal investigations into X Internet Unlimited Company and X.AI LLC over the processing of personal data in the Grok AI system, examining whether personal data was processed lawfully, fairly and transparently, and whether appropriate safeguards were built in to prevent harmful manipulated images. Ofcom is running its own separate investigation, and the two regulators say they are coordinating.

Data Protection Officers and DPIAs

When a DPO Is Required

Certain organisations must appoint a Data Protection Officer (DPO). Appointment is mandatory when:

• The organisation is a public authority or public body (except courts in their judicial capacity)
• Its core activities require regular and systematic monitoring of individuals on a large scale
• Its core activities involve processing special category data or criminal conviction data on a large scale

Voluntary DPO appointment is permitted; once appointed, the same statutory requirements apply regardless of whether appointment was mandatory.

Data Protection Impact Assessments (DPIAs)

A DPIA is required before processing likely to result in high risk to individuals' rights and freedoms. Mandatory contexts include processing involving new technology, large-scale profiling, systematic monitoring of public areas, and large-scale special category data processing. Where a DPIA identifies unresolvable high risk, the organisation must consult the ICO before proceeding.

How UK Data Privacy Law Compares to the EU GDPR

The UK and EU frameworks share the same foundations but are diverging as the DUAA takes effect.

Organisations that comply with the EU GDPR are generally well-positioned for UK GDPR compliance, but should review the DUAA-specific changes separately.

Recent Developments (2025-2026)

ICO children's enforcement intensifies (2026). The Reddit (GBP 14.47m) and Imgur (GBP 247,590) fines in February 2026, combined with the ICO's review of age assurance on 17 platforms popular with children (including Discord, Pinterest and X) and its investigation into X and xAI over Grok, signal that age assurance requirements and children's DPIA obligations are under active enforcement.

ICO Grok/AI investigation (2026). The ICO's formal investigation into X and xAI over the Grok system's use of personal data to generate sexualised images, running alongside a separate Ofcom investigation, is a major test of how UK data protection law applies to generative AI.

DUAA Part 5 in force from 5 February 2026. The main data protection amendments are now operative, requiring organisations to review legitimate interests assessments, automated decision-making policies, SAR processes, and cookie consent banners.

EU adequacy renewed to 2031 (19 December 2025). The European Commission formally renewed both UK adequacy decisions, extending free data flows from the EEA to the UK until 27 December 2031.

ICO cookie guidance finalised (29 April 2026). The ICO finalised its guidance on storage and access technologies, covering the new PECR cookie exemptions, after consulting on draft versions.

Information Commission transition set for 30 September 2026. SI 2026/1015, made on 10 September 2026, commences DUAA sections 117(4)(a), 118 and 119 on 30 September 2026. From that date the office of Information Commissioner is abolished and its functions pass to the Information Commission, a body corporate. Regulation 3 carries over acts, omissions and legal proceedings already under way, so existing complaints and enforcement do not restart.

For related guidance, see our article on UK recording laws and the World Data Privacy Laws hub.

Practical Compliance Steps for Organisations

Organisations processing UK personal data should take the following steps to ensure compliance as of 2026:

1. Map all processing activities and maintain a Record of Processing Activities (ROPA) under Article 30 of the UK GDPR
2. Review legitimate interests assessments in light of the DUAA recognised legitimate interests and early ICO guidance; update documentation if relying on any of the five recognised categories
3. Audit automated decision-making processes and implement the DUAA-mandated safeguards: information disclosure to data subjects, right to challenge, and human review mechanism
4. Update SAR procedures to apply the DUAA stop-the-clock where appropriate when requesting clarification from data subjects
5. Review cookie consent banners against the new PECR Regulation 6 exemptions; update privacy notices to reflect changes in analytics and functionality cookie treatment
6. Check international transfer mechanisms: confirm adequacy status of destination countries, and review existing IDTAs and Addenda for any DUAA-driven updates signalled by the ICO
7. Conduct DPIAs for any processing involving children, new technologies, AI systems, or large-scale profiling, and ensure documentation is current
8. Implement breach response plans enabling ICO notification within 72 hours and individual notification for high-risk breaches
9. Appoint a DPO if required under the three mandatory criteria, or designate a responsible data protection person and document the decision
10. Operate a complaints process that meets DPA 2018 s.164A (in force since 19 June 2026): make complaints easy to submit, including electronically, acknowledge them within 30 days, and respond and report the outcome without undue delay

This article provides general legal information, not legal advice. Data protection law is complex and subject to ongoing development through DUAA commencement orders and ICO guidance. Consult a data protection solicitor for advice tailored to your organisation's specific circumstances. UK law information verified as of 30 September 2026.

Related UK Data Privacy Guides

• How to Make a Subject Access Request (SAR)
• How to Complain to the ICO
• Data Breach Reporting: The 72-Hour Rule
• The Right to Erasure (Right to Be Forgotten)
• UK criminal record checks and data rights by nation (DBS, Disclosure Scotland, AccessNI)

This guide is part of our United Kingdom law guides.

Frequently Asked Questions

What is the difference between UK GDPR and EU GDPR?

The UK GDPR is the version of the EU GDPR incorporated into UK domestic law after Brexit through the European Union (Withdrawal) Act 2018. Both share the same core principles, rights framework, and penalty structure. Key differences have grown with the Data (Use and Access) Act 2025: the UK has introduced recognised legitimate interests (five public-interest categories exempt from the balancing test), a more permissive automated decision-making framework, expanded PECR cookie exemptions, a stop-the-clock mechanism for SARs, and a simplified adequacy test for international transfers. The UK GDPR is enforced by the ICO (transitioning to the Information Commission), with fines denominated in GBP up to GBP 17.5 million, while the EU GDPR is enforced by national supervisory authorities with fines in EUR up to EUR 20 million.

What is the Data (Use and Access) Act 2025 and when did it come into force?

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It is the most significant reform to UK data protection law since the Data Protection Act 2018 and amends the UK GDPR, DPA 2018, and PECR. The Act was commenced in stages: technical provisions from 20 August 2025, digital identity and child safety provisions from 1 December 2025, and the main data protection amendments (recognised legitimate interests, automated decision-making, SAR stop-the-clock, and PECR cookie changes) from 5 February 2026. The complaints provisions in section 103 followed on 19 June 2026 (SI 2026/82), and SI 2026/1015 fixes 30 September 2026 as the date the office of Information Commissioner is abolished and its functions transfer to the Information Commission.

What are recognised legitimate interests under the DUAA 2025?

Recognised legitimate interests are five specific public-interest processing purposes for which Parliament has determined the legitimate interest automatically outweighs data subjects' rights, removing the need for organisations to conduct the balancing test step of the usual legitimate interests assessment. The five categories are: national security, public security, or defence; preventing, detecting, investigating, or prosecuting crime; safeguarding vulnerable individuals including children; responding to emergencies under the Civil Contingencies Act 2004; and assisting public bodies in performing statutory tasks. Direct marketing, intra-group transmission for internal administrative purposes, and network security are not recognised legitimate interests; they are listed only as examples of ordinary legitimate interests that still require a full three-part assessment.

What are the penalties for violating UK data privacy laws?

The ICO enforces a two-tier penalty structure. The higher tier allows fines of up to GBP 17.5 million or 4% of total annual worldwide turnover, whichever is greater, for serious violations including breaches of data protection principles, processing without a lawful basis, and violating data subject rights. The standard tier allows fines of up to GBP 8.7 million or 2% of global turnover for less severe breaches. Following the DUAA, PECR infringements can also attract fines up to GBP 17.5 million or 4% of turnover, compared to the previous GBP 500,000 maximum.

How quickly must a data breach be reported to the ICO?

Under Article 33 of the UK GDPR, organisations must report a qualifying personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Not all breaches require notification; only those likely to result in a risk to individuals' rights and freedoms. Where a breach is likely to result in a high risk, the organisation must also notify affected individuals directly. Phased reporting is permitted: initial information can be provided within 72 hours with further details following as the investigation progresses. Failing to report when required can result in a fine of up to GBP 8.7 million or 2% of global turnover.

Can EU organisations still transfer personal data to the UK after Brexit?

Yes. The European Commission renewed its adequacy decisions for the UK on 19 December 2025, extending them until 27 December 2031. Both decisions cover transfers under the EU GDPR and under the Law Enforcement Directive. EU and EEA organisations can therefore continue to send personal data to the UK without Standard Contractual Clauses or other Article 46 safeguards. The Commission assessed that the Data (Use and Access) Act 2025 did not lower UK data protection standards.

What are the new cookie rules under the DUAA 2025?

The DUAA amended Regulation 6(1) of PECR to expand the categories of cookies that may be placed without prior user consent. In addition to strictly necessary cookies, websites can now use cookies without consent for: statistical or analytics purposes aimed at improving the service, website appearance and functionality tailored to user preferences, and locating a user who asks for, or appears to need, emergency assistance. The strictly necessary exemption now expressly covers security, fraud and fault detection. For the analytics and appearance exemptions, users must be given clear and comprehensive information and a simple, free means of objecting. PECR fines were also increased to match the UK GDPR maximum of GBP 17.5 million or 4% of turnover.

What is the Information Commission and when does it take over from the Information Commissioner?

The Information Commission is the data protection regulator that takes over the functions of the Information Commissioner under the Data (Use and Access) Act 2025, and it continues to be known as the ICO. Unlike the Information Commissioner, a corporation sole with authority vested in one person, the Information Commission is a body corporate governed by a board comprising a Chair, a CEO, and seven non-executive members. Paul Arnold has been appointed as the first CEO on an interim basis. The handover date is fixed by SI 2026/1015, made on 10 September 2026: on 30 September 2026 the office of Information Commissioner is abolished and its functions transfer to the Information Commission. Regulation 3 of those Regulations treats acts, omissions and legal proceedings already under way as continuing by or in relation to the Commission, so open complaints and enforcement do not restart.