Data (Use and Access) Act
The principal data protection provisions of the Data (Use and Access) Act 2025 (DUAA) came into force on 5 February 2026, including the new recognised legitimate interests grounds, revised automated decision-making rules and simplified international transfers. The maximum fine for PECR breaches also increased from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher. A new requirement for controllers to acknowledge data protection complaints within 30 days came into force on 19 June 2026. The Act amends the UK GDPR and Data Protection Act 2018 (rather than being a standalone statute). The ICO has published guidance on the changes. The DUAA also introduced major amendments to the Data Protection Act 2018 when it comes to the regulatory regime. In the coming months, the Information Commissioner’s Office will be replaced by an Information Commission. It had been planned that John Edwards, until recently the Commissioner, would become Chair of the new Commission. However he resigned from his role in June, following serious concerns about his workplace conduct. This means that a new Chair will need to be recruited. It will be important to monitor whether this leads to any changes in regulatory and enforcement focus.
Direct Marketing Code of Practice
The ICO published updated direct marketing guidance in April 2026, reflecting changes under the Data (Use and Access) Act 2025. The statutory direct marketing code of practice, required since 2018, remains unpublished.
ICO guidance on automated decision-making in recruitment
On 31 March 2026, the ICO published a report on the use of automated decision-making (ADM) in recruitment alongside a consultation on updated ADM and profiling guidance. Drawing on evidence from more than 30 employers, the ICO's key finding was that many organisations using AI hiring tools believed those tools were supporting human decisions when, in practice, they were making solely automated decisions with no meaningful human involvement. The consultation closed on 29 May 2026 and final guidance is expected in summer 2026. Employers using AI for CV screening, shortlisting or candidate ranking should treat the report as a signal that enforcement in this area is increasing. The Government is also currently consulting on proposals to support the fair, transparent and responsible use of workplace monitoring technologies.