How we will regulate as the Data (Use and Access) Act commences
Latest updates - 19 June 2025
19 June 2025 - This page was published
The Data (Use and Access) Act (DUAA) received Royal Assent on 19 June 2025 and will come into effect in phases.
We will continue to regulate the DPA 2018, UK GDPR and PECR, which stay in force, but will be amended by the DUAA. Organisations should follow the existing law until various parts of the DUAA are expected to commence at two, six and 12 months after Royal Assent.
We want to provide reassurance to businesses about how the changes impact our regulatory action.
It’s important to understand that we apply the law as it stands at the time an infringement took place, rather than the date that we received any complaint or report or when the infringement was detected.
In some cases, we will need to exercise our discretion when considering regulatory action on alleged non-compliance with an existing provision under the data protection legislation which is going to be removed, amended or replaced with a similar provision under the DUAA. We will make a judgement on whether to proceed with regulatory action under the old provision or, where there is ongoing non-compliance, consider action under the new provisions.
When considering regulatory action on the DUAA’s new provisions, we will consider the ICO guidance available to organisations at the time of the alleged non-compliance.
The DUAA provides us with new powers, including the power to:
- compel a witness to attend an interview;
- request technical reports; and
- issue fines of up to £17.5m or 4% of global turnover under PECR.
We are required to produce statutory guidance on the use of these new powers and will consult publicly nearer to their commencement.
The DUAA brings in some new requirements for organisations. We will be publishing new and updated guidance to reflect these changes. Our planned guidance pages will set out when to expect new and draft guidance to give organisations certainty.
All website guidance pages relevant to DUAA changes will explain that the law is changing and where to find out more information.