{"id":424104,"date":"2026-02-13T19:24:08","date_gmt":"2026-02-13T19:24:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/424104\/"},"modified":"2026-02-13T19:24:08","modified_gmt":"2026-02-13T19:24:08","slug":"uk-data-reform-becomes-reality-what-this-means-for-you-and-what-you-need-to-do-next-privacy-protection","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/424104\/","title":{"rendered":"UK Data Reform Becomes Reality: What This Means For You And What You Need To Do Next – Privacy Protection"},"content":{"rendered":"

<\/p>\n

LS<\/p>\n

<\/p>\n

Lewis Silkin<\/p>\n


\n <\/a><\/p>\n

More<\/p>\n


\n <\/p>\n


\n \"Lewis
\n <\/a><\/p>\n


\nWe have two things at our core: people \u2013 both ours and yours – and a focus on creativity, technology and innovation.
\nWhether you are a fast growth start up or a large multinational business, we help you realise the potential in your people and navigate your strategic HR and legal issues, both nationally and internationally. Our award-winning employment team is one of the largest in the UK, with dedicated specialists in all areas of employment law and a track record of leading precedent setting cases on issues of the day. The team\u2019s breadth of expertise is unrivalled and includes HR consultants as well as experts across specialisms including employment, immigration, data, tax and reward, health and safety, reputation management, dispute resolution, corporate and workplace environment. \n <\/p>\n

<\/p>\n


\n Delayed from 19 December 2025 due to the festive season, commencement order number 6 for the Data (Use and Access) Act 2025 (DUAA) crept onto the statute books with little fanfare. \n <\/p>\n


\n United Kingdom
\n Privacy \n <\/p>\n


\n To print this article, all you need is to be registered or login on Mondaq.com. \n <\/p>\n

Article Insights<\/p>\n

Lewis Silkin are most popular: <\/p>\n


\n within Cannabis & Hemp, Insolvency\/Bankruptcy\/Re-Structuring and Transport topic(s)
\n in United Kingdom
\n with readers working within the Retail & Leisure industries <\/p>\n

Delayed from 19 December 2025 due to the festive season,\u00a0commencement
\norder number 6<\/a>\u00a0for the Data (Use and Access) Act 2025
\n(DUAA) crept onto the statute books with little fanfare. In case
\nyou missed it, 5 February 2026, is the day when most of the
\nremaining provisions of DUAA entered into force.<\/p>\n

A swathe of provisions got the green light, including the new
\napproach to ADM, which unless special category data is involved,
\nmoves to a permission but with safeguards\u00a0regime, meaning
\ncertain decisions may no longer be subject to the more severe
\nrestrictions on automated decision-making. (For more information
\nsee the ADM section of our article\u00a0
\nhere<\/a>).<\/p>\n

The new UK test for data bridges (formerly known as
\n“adequacy”, pre-Brexit) also enters into force, meaning
\nthe test is now whether the standards of data protection will be
\n“materially lower” than those applicable in the UK.
\n(Previously the test was whether the standards were
\n“essentially equivalent”).\u00a0You may want to take
\nadvantage of the new test when completing your Transfer Risk
\nAssessments (TRAs) for transfers from the UK but there is no
\nurgency to review existing TRAs as they will remain fit for
\npurpose. (For more information see the Data Transfers section in
\nour article\u00a0
\nhere<\/a>).<\/p>\n

Also in force are the remaining amendments to the\u00a0Privacy
\nand Electronic Communications Regulations 2003<\/a>\u00a0(PECR),
\nincluding the headline grabbing UK GDPR level fines (i.e. maximum
\n\u00a317.5 million or 4% of global annual turnover, whichever is
\nhigher), the extension of the cookie consent rules to anyone who
\n“instigates” the storage or access to stored data, wider
\nenforcement powers for PECR breaches, soft opt-in for charities,
\nthe relaxation of exemptions for cookie consent where they pose a
\nlow risk to user privacy and the ICO’s task of encouraging
\nindustry to produce codes of conduct. (For more information see our
\ne-Privacy section in our article\u00a0
\nhere<\/a>). We know the ICO is very active when it comes to PECR
\nbreaches so anyone taking a risk based view on PECR requirements
\nparticularly in respect of marketing campaigns should be
\nreconsidering their risk profile given the stakes have become
\nsignificantly higher for non-compliance!<\/p>\n

The remaining data rights, bar one, are also commenced,
\nclarifying time limits for responding to data subjects’
\nrequests, the information to be provided to data subjects and fees
\nand reasons for responses to data subjects’ requests about law
\nenforcement processing. The remaining right, yet to be commenced,
\nis the new “right to complain” to controllers regarding
\ngeneral UK GDPR compliance. (For more information see the Data
\nRights section of our article\u00a0
\nhere<\/a>). This right will come into force on\u00a019 June
\n2026\u00a0so if you haven’t already reviewed your
\ncomplaints process, worked out how to resource it given the likely
\nincrease in direct complaints and revised your privacy notices, the
\nclock is ticking with little over 4 months to get your house in
\norder. Keep an eye out for the ICO’s\u00a0
\nfinal guidance<\/a>\u00a0too, which is still expected Winter
\n2025\/2026 (even if we are now, thank goodness, through the 2025
\npart of Winter!) .<\/p>\n

All the new wide-ranging ICO powers are in force, bringing the
\nICO into line with other UK regulators. (For more information see
\nthe IC’s new powers section of our article\u00a0
\nhere<\/a>). Again, if you haven’t already familiarised yourself
\nwith the powers, it would be prudent to do so as these will change
\nhow the ICO currently conducts its investigations.<\/p>\n

Finally, both the new “recognised legitimate
\ninterests” lawful basis and the purpose limitation
\nclarification are also brought into force. (For more information
\nsee the relevant sections of our article\u00a0
\nhere<\/a>). We don’t think either provision will have a huge
\nimpact on organisations, rather they provide welcome clarity and
\nfor most of us the legitimate interests assessment (LIA) will still
\nbe necessary, unless you fall within the narrow scope of the new
\n“recognised legitimate interests”. If this is the case
\nand you seek to rely on this new lawful basis you will need to
\nupdate your privacy notices and ROPAs to reflect this.\u00a0<\/p>\n

We still await the changes to the ICO’s structure. (For more
\ninformation see the IC section of our article\u00a0
\nhere<\/a>). It remains to be seen when the Information Commission
\nwill come into being but with appointments to the new Board well
\nunderway it might be sooner, rather than later.\u00a0<\/p>\n

So what?<\/p>\n

As it was third time lucky before data reform was enacted in the
\nUK, many compliance teams preferred to wait until DUAA received
\nRoyal Assent and there was certainty about the road ahead. Now with
\nthe majority of provisions in force the direction of travel is
\nclear, so if you haven’t already refreshed your policies and
\nprivacy notices, considered your TRAs for transfers from the UK,
\ndiscussed what the ADM changes mean for your organisation, what the
\nnew PECR reforms mean for your marketing strategy, how the new ICO
\npowers will impact your approach to regulatory investigations etc.
\netc., now is the time to do so.<\/p>\n

The content of this article is intended to provide a general
\nguide to the subject matter. Specialist advice should be sought
\nabout your specific circumstances.<\/p>\n

[View Source] <\/a><\/p>\n","protected":false},"excerpt":{"rendered":" LS Lewis Silkin More We have two things at our…\n","protected":false},"author":2,"featured_media":15222,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":{"0":"post-424104","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-united-kingdom","8":"tag-gb","9":"tag-great-britain","10":"tag-greatbritain","11":"tag-news","12":"tag-uk","13":"tag-united-kingdom","14":"tag-unitedkingdom"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/424104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=424104"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/424104\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/15222"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=424104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=424104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=424104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}