One year on: marking the 12-month commencement of the Data (Use and Access) Act

It has been a year since the Data Use and Access Act (DUAA) gained Royal Assent, and 19 June 2026 marked the Act’s commencement. It's a significant milestone for UK organisations and the public. The changes in the law offer opportunities for innovation as well as help protect people’s personal information, building public trust in businesses and the public sector.

We’re working hard to make sure organisations and the public understand what has changed and what it means for them in practice.

I wanted to take this opportunity to reflect on what we've delivered over the past twelve months, share an update on our new powers, and point you to where you can find the latest guidance.

What we've been focused on

Over the last year, our priority has been providing practical, accessible support to help organisations get to grips with the changes the new Act has introduced. This has involved publishing new and updated guidance, particularly in areas where organisations needed time to prepare for new operational requirements, such as having a data protection complaints handling process.

We tackled 13 high-priority guidance areas first, focusing on the policy areas most impacted by the Act, as well as making essential changes to some of our most-visited guidance products, such as the right of access guidance. This has allowed us to give organisations regulatory certainty on the most important topics as quickly as possible.

To inform this work, we have delivered 11 DUAA-related consultations on high-impact topics; covering direct marketing, recognised legitimate interest, complaints, research, and automated decision-making, among others. Between them, we received over 300 responses. The insights we gathered are now reflected in our new and updated guidance.

Our new powers

The DUAA also provides us with important new powers. Our aim is to give businesses certainty about what to expect by publishing guidance before we begin using them. However, the law has commenced and we can, and will, use these powers where necessary for the most serious cases.

Among the new powers is the ability to compel a witness to attend an interview and to request reports of approved persons. Our new draft enforcement procedural guidance sets out the process we will follow when using these powers, carrying out investigations, taking enforcement action, and exercising some of our other duties. We will be publishing the final guidance in due course.

The DUAA also gives us the power to issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR). We are currently developing separate guidance to cover these higher fines.

What's coming next

We'll continue publishing new and updated guidance throughout the summer, prioritising the areas of greatest impact. We're taking a risk-based approach to make sure we focus our efforts in the right places.

You can keep track of what's coming through our guidance pipeline, which is the best place to stay up to date on upcoming guidance and consultations. We're also starting work on a new statutory code of practice on artificial intelligence and automated decision making, and we'll share more detail on timings through our new codes of practice pipeline in due course.

Thank you to everyone who has engaged with our consultations and provided feedback over the past year. It genuinely has made a huge difference for how we can continue to support you.