General data protection

Guidance stages explained

Drafting – During this stage we pull together all relevant information and create a structured draft.

Public consultation/call for views (optional) – Usually we carry out a public consultation or call for views before we complete the guidance. To understand more about how and when we do this, you can read our consultation policy.

Redrafting (following consultation) – We make changes to the draft guidance to clarify issues and meet the needs of our audience.

Withdrawn – Occasionally we decide to not proceed with a guidance project. If so, we’ll mark it as withdrawn and remove it when we next update this page. If we decide to revisit an issue, we add a new entry to this page.

Published – Guidance is final and available on the website

List of guidance in development

Codes of Conduct and Certification Guidance Update

To reflect changes in the rules around Codes of Conduct in the Data (Use and Access) Act, and also changes to our processes.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026

Complaints guidance for organisations

Guidance for organisations on how to handle data protection complaints following the requirements introduced by the Data (Use and Access) Act.
Stage: Redrafting (following consultation)
Public consultation: Yes (closed)
Final version of guidance due for publication: Winter 2025/2026

Data sharing for scams and frauds

Update to advice to reflect new provisions in the DUA Act
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026

International Transfers guidance

Stage: Redrafting (after public consultation)
Public consultation: Yes (closed)
Final version of guidance due for publication: Winter 2025/2026

Lawful basis guidance update

Update of existing guidance to cover Data (Use and Access) Act changes
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026

Legitimate interest update

Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026

Public task guidance

Stage: Published
Public consultation: No
Final version of guidance due for publication: How to comply with your information request obligations at a time of organisational change

Recognised legitimate interest

Guidance for organisations on the new lawful basis introduced by the Data (Use and Access) Act
Stage: Public consultation/Call for views
Public consultation: Yes (open)
Final version of guidance due for publication: Winter 2025/2026

Recognised legitimate interest update to lawful basis interactive guidance tool

Update of existing guidance tool to include the recognised legitimate interest lawful basis amendment from the Data (Use and Access) Act
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026

Research, Archiving and Statistics Provisions update

To include new amendments from the Data (Use and Access) Act.
Stage: Drafting
Public consultation: Yes (due to launch Winter 2025/26)
Final version of guidance due for publication: Summer 2026

Right of access detailed guidance

Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026

SME Data essentials

Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Spring 2026

The purpose limitation principle

To include update to existing guidance and additional guidance.
Stage: Drafting
Public consultation: No
Final version of guidance due for publication: Winter 2025/2026