Our fourth objective focuses on ensuring we have the right people, skills and resources to deliver our mission effectively.

Implementing the DUAA

Part of our transformation activity this year has focused on ensuring that legislative change is implemented effectively. The DUAA represents the most significant reform to data protection legislation since 2018. The Act received Royal Assent on 19 June 2025, with the first provisions coming into force in August 2025.

The Act gives organisations using personal information new and better opportunities to innovate and grow in the UK. It also further improves our ability to balance innovation and economic growth with strong protections for people’s rights.

Key changes include:

• new powers for us, including the ability to: 
  • compel witnesses to attend interviews; 
  • request technical reports; and 
  • issue higher fines under PECR;
• the establishment of the UK Information Commission as our new statutory governance structure;
• new provisions including the ‘recognised legitimate interest’ lawful basis;
• improved requirements for ADM transparency; and
• obligations for organisations to have their own data protection complaints process.

We published comprehensive guidance to support organisations and the public as these changes are introduced, including outlines of what the Act means for people, organisations and law-enforcement agencies.

Developing a new strategy

It is essential that we have a clear strategy setting out how we’ll regulate to maximise our impact. An important part of our work this year was in developing a new corporate strategy. At the time of writing, we expect this strategy to be launched for consultation in summer 2026. 

We remain committed to working with government, businesses, and civil society to ensure that data protection: 

• supports economic growth; 
• protects individuals; and 
• maintains public trust in the digital economy.

Preparing for the future

We signed a lease on our new Manchester head office during the year. We’ve begun detailed planning for the fit-out, with occupancy planned for autumn 2026. This relocation will create a working environment that will:

• better support how we operate now and into the future; 
• improve our ability to attract new and diverse talent; and
• strengthen the way we work with the wider sector.

Our transformation programmes continue to deliver improvements across our organisation. Our new Regulatory Action Framework brought a principle-based framework to:

• reduce siloed working; and 
• inform better regulatory interventions. 

We rolled out a comprehensive leadership training programme across our organisation. 

We introduced a new approach to handling data protection complaints, making the process clearer and more effective for the public and organisations. We designed the data protection complaints framework to deliver faster and more impactful outcomes, particularly for people whose complaints raise the most serious concerns. We’ll use the information we gather to: 

• monitor compliance across sectors; 
• spot trends; and 
• influence our work with organisations to improve data rights practices.

We also increased our responsible use of data and AI in a range of use cases from office productivity and case creation to exploring how it could scale up our regulatory supervision activities. To support this, we: 

• upskilled our people in data and AI; 
• strengthened our information and data governance approaches; and 
• published our own AI Use Policy. 

We are already seeing the benefits of trialling this new technology. We produced: the initial draft of the annual report narrative you’re currently reading using the Government Communications Service’s Assist AI tool. Our directors and communications team then shaped it into its final version.