On February 5, 2026, the next phase of the UK Data (Use and Access) Act (“DUAA”) officially came into force, bringing most of its provisions, including the major reforms under Part 5, into effect. However, a notable exception is Section 103, which requires organizations to implement a formal complaints procedure; this requirement is scheduled to take effect on June 19, 2026, approximately 12 months after the DUAA received Royal Assent. Additionally, certain provisions related to the restructuring of the UK Information Commissioner’s Office (“ICO”) will commence at a later date. For more information on the DUAA’s implementation timeline, see our previous blog here.
The DUAA grants the ICO new powers to strengthen its regulatory oversight. These include the authority to compel witnesses to attend interviews, require technical reports, and issue substantial fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations.
To mark the commencement of the main provisions of the DUAA, the ICO has updated its suite of guidance materials to help organizations navigate the new regulatory framework. In particular, the ICO updated its ‘Data protection by design and by default’ guidance which now includes a subsection on the ‘children’s higher protection matters’ duty introduced by the DUAA, alongside updated guidance on subject access requests. For more information regarding the concept of ‘children’s higher protection matters’ read our previous blog here. For law enforcement bodies, the ICO updated its guidance on Part 3 codes of conduct.
Read the UK ICO press release here.