What the Data (Use and Access) Act 2025 means for your privacy policy
The Data (Use and Access) Act 2025, often searched for as the Data Use and Access Act, changed UK data protection law in stages. Three dates in 2026 matter for privacy policies, and most policies written before them are now out of date.
Last checked against legislation.gov.uk on 14 October 2026. This is general information, not legal advice.
In short. If your privacy policy was last updated before 19 June 2026, it almost certainly needs at least one change: it must now tell people they can complain to you. If it was last updated before 30 September 2026, it probably names the Information Commissioner's Office, which has since become the Information Commission.
Data (Use and Access) Act 2025 summary: the three dates
| Date | What changed | What it means for your policy |
|---|---|---|
| 5 February 2026 | New rules on automated decisions, recognised legitimate interests, international transfers, and new cookie exemptions | Review the sections on automated decisions, lawful basis, transfers and cookies |
| 19 June 2026 | Every organisation must handle data protection complaints itself | The policy must tell people they can complain to you |
| 30 September 2026 | The Information Commissioner was replaced by the Information Commission | Update the regulator's name. Old references still count in law |
The Act received Royal Assent on 19 June 2025. The dates come from the commencement regulations, SI 2026/82 and SI 2026/1015.
1. The right to complain to you (19 June 2026)
From 19 June 2026, anyone can complain directly to an organisation if they think it has broken data protection law in handling their information. This is section 164A of the Data Protection Act 2018. The organisation must:
- make complaints easy to make, for example with a complaint form that can be filled in online and by other means;
- acknowledge each complaint within 30 days of receiving it;
- without undue delay, take appropriate steps to respond, including looking into the complaint and keeping the person told of progress;
- without undue delay, tell the person the outcome.
On the same date a new item was added to the list of things a privacy notice must say: the right to make a complaint to the controller (UK GDPR Article 13(2)(ca), and Article 14(2)(da) where you got the data from someone else). There are no exemptions for small organisations.
Get a free data protection complaints procedure template that follows these steps.
Sources: Data Protection Act 2018, section 164A; UK GDPR Article 13.
2. The Information Commission (30 September 2026)
On 30 September 2026 the office of the Information Commissioner was abolished and its work moved to a new body, the Information Commission. A privacy notice must still tell people they can complain to the regulator, and Article 13(2)(d) now refers to "the Commission".
You do not have to rush. The Act says references to the Commissioner in existing documents are to be read as references to the Commission, so an older policy that says "ICO" is not unlawful for that reason alone. Update the name at your next review.
Sources: Data (Use and Access) Act 2025, section 119; SI 2026/1015. We could not confirm from our build environment whether the regulator still uses the ICO name, website and helpline, so check its website for current contact details.
3. Automated decision-making (5 February 2026)
The old Article 22 was replaced by Articles 22A to 22D. A "significant decision" (one with a legal or similarly significant effect) taken with no meaningful human involvement is now generally allowed, but only with safeguards. You must give people information about the decision, let them make representations, let them get human intervention, and let them contest it. Decisions that use special category data, or that rely on recognised legitimate interests, are still restricted.
If you make such decisions, your privacy policy must say so and give meaningful information about the logic involved and the likely consequences (Article 13(2)(f)).
Sources: UK GDPR Article 22A, Article 22C.
4. Cookies and analytics (5 February 2026)
The Privacy and Electronic Communications Regulations (PECR) now have a Schedule A1 listing cases where you do not need consent to store or read information on someone's device. The one most businesses ask about is analytics. You can use cookies or similar technology without consent to collect statistics about how your website or service is used, but only if all of these are true:
- the sole purpose is to collect statistics so you can improve your service or website;
- the information is not shared with anyone else, except to help you make those improvements;
- people get clear and comprehensive information about the purpose; and
- people have a simple, free way to object, and have not objected.
Advertising and cross-site tracking are not covered and still need consent. Whether a particular analytics tool meets the "not shared" condition depends on how it is set up and what its provider does with the data, so check its settings and terms. If in doubt, ask for consent.
Source: PECR Schedule A1, paragraph 5.
5. Sending data abroad (5 February 2026)
The test for sending personal data outside the UK changed. Transfers are now judged on whether the protection in the destination is "not materially lower" than in the UK. Your policy must still say if data leaves the UK and what protects it, such as UK adequacy regulations or the International Data Transfer Agreement.
Sources: UK GDPR Article 45B; Article 13(1)(f).
6. Recognised legitimate interests (5 February 2026)
A new lawful basis, Article 6(1)(ea), covers processing that is necessary for a "recognised legitimate interest", such as preventing crime or safeguarding vulnerable people. Unlike ordinary legitimate interests, it does not need a balancing test. If you rely on it, say so in your policy alongside your other lawful bases.
Sources: UK GDPR Article 6; Annex 1.
Your 2026 update checklist
- Add the right to complain to you, and how to do it.
- Set up a complaints procedure that acknowledges complaints within 30 days.
- Change "Information Commissioner's Office" to "Information Commission" at your next review.
- If you make automated decisions about people, explain them and the safeguards.
- Check your cookie information matches what your website actually uses.
- If data leaves the UK, name the safeguard.
- Put a "last updated" date at the top.
Check your policy against these changes
The Privacy Register reads your existing policy and website and shows which of these changes it is missing, with suggested wording. Free, no sign-up.
Questions
Is it the Data Use and Access Act 2025 or 2026?
The Act is the Data (Use and Access) Act 2025. It became law on 19 June 2025, but most of the changes that affect privacy policies came into force in 2026, on 5 February, 19 June and 30 September.
Do small businesses need a data protection complaints procedure?
Yes. Section 164A applies to every controller, with no exemption for size. You must make complaints easy to make, acknowledge them within 30 days, look into them and tell the person the outcome.
Is my privacy policy unlawful because it still says "ICO"?
Not for that reason alone. The Act says references to the Information Commissioner in existing documents are read as references to the Information Commission. Update the name when you next review the policy.
Can I use Google Analytics without cookie consent now?
Possibly, but only if every condition in PECR Schedule A1 paragraph 5 is met: the sole purpose is statistics to improve your own site, the data is not shared except to help with that, visitors are told, and they can object simply and free of charge. Whether a given setup meets the "not shared" condition depends on its settings and the provider's terms. Advertising features always need consent.