Codes of conduct detailed guidance
Latest updates - last updated 5 February 2026
5 February 2026 – The Data Use and Access Act 2025 (DUAA) makes changes in relation to codes of conduct.
It allows for codes of conduct to be developed under part 3 of the Data Protection Act 2018, and under the Privacy and Electronic Communications Regulations (PECR).
It also amends article 41 of the UK GDPR to clarify when a monitoring body should tell the ICO about an infringement of a code of conduct.
We have updated our guidance to reflect these changes.
Legislative requirements
To help you to understand the law and good practice as clearly as possible, this guidance says what organisations must, should, and could do to comply.
Must refers to:
- legislative requirements within our remit; or
- established case law (for the laws that we regulate) that is binding.
Good practice
- Should does not refer to a legislative requirement, but what we expect you to do to comply effectively with the law. We expect you to do this unless there is a good reason not to. If you choose to take a different approach, you need to be able to be able to demonstrate that this approach also complies with the law.
- Could refers to an option or example that you may consider to help you to comply effectively. There are likely to be various other ways for you to comply.
We are committed to encouraging the development of codes of conduct and will provide advice and support from the start on:
- meeting the necessary criteria;
- understanding the requirements of the relevant data protection laws; and
- addressing complex areas of data protection.
We welcome informal discussions with organisations as part of the development of your code of conduct and prior to beginning the application process. You’re strongly encouraged to contact us at [email protected].
About this detailed guidance
This guidance discusses codes of conduct in detail. Read it if you have detailed questions not answered in the guide, or if you need a deeper understanding. This guidance will be useful for organisations considering writing, monitoring or signing up to a code of conduct.