# Data protection If your organisation holds details about customers, staff or anyone else, these are the rules it works within. The Assurance Desk. Last checked 2 October 2026. ## Explore data protection ### Understand the rules - [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md): Turn the rules into everyday checks on the information your organisation uses. - [Data protection training: what should staff learn?](https://theassurancedesk.com/guides/data-protection-training-for-staff.md): A useful course helps people handle real situations and shows where they still need help. - [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md): Connect the risks to people with the safeguards and checks your organisation uses. - [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md): Recognise the request, work out the deadline and organise a clear, secure response. - [UK GDPR versus EU GDPR: which rules apply?](https://theassurancedesk.com/guides/uk-gdpr-vs-eu-gdpr.md): A UK address does not settle which data protection law covers every part of your business. - [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md): Explain what happens to people’s information at the point they need to know. - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md): Start with the personal data you hold, then check your duties, fee and need for a DPO separately. - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md): Follow the decisions about the data, rather than the label on the contract. - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md): Use this checklist to see what the supplier will do with personal data, including when the work ends. - [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md): The law has changed, but your old data protection duties have not disappeared. - [Automated decisions: what UK GDPR now requires](https://theassurancedesk.com/guides/automated-decisions-uk-gdpr.md): Check what a system decides, who reviews it and how someone can challenge the result. - [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md): Check the exemption first, then the right fee band, before paying a letter or invoice. ### Appoint a DPO - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md): Ask this before you hire anyone, because the answer changes what you need to buy. - [Can your IT manager be your DPO?](https://theassurancedesk.com/guides/can-your-it-manager-be-your-dpo.md): The job title is not the test, but the decisions that come with it matter. - [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md): Start with the person doing the job, the cover you need and the way they will work with your team. - [Is a data protection officer a senior role?](https://theassurancedesk.com/guides/is-a-data-protection-officer-a-senior-role.md): Look at the person’s authority, access and independence as well as their job title. - [Schools and academies: who can be your DPO?](https://theassurancedesk.com/guides/schools-and-academies-who-can-be-your-dpo.md): Compare the appointment options for schools in England and the checks that help you choose someone who can do the job. - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md): The lowest monthly fee we found published for an outsourced DPO is £350 plus VAT, for two hours a month. - [Day rate or retainer: how do consultants charge?](https://theassurancedesk.com/guides/data-protection-consultant-day-rate-or-retainer.md): Compare the work, access and limits in the proposal before comparing the headline fee. - [How much does data protection software cost per year?](https://theassurancedesk.com/guides/how-much-does-data-protection-software-cost-per-year.md): Check what the licence covers, how the bill grows and which costs sit outside the subscription. ### Choose an adviser - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md): Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do. - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md): Knowing who pays, and what insurance covers, helps you ask the right questions before you sign. - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md): A job title says little, so it helps to know what to ask for and what each certificate shows. - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md): Ask who owns the product, how the adviser is paid and what happens if you choose a different tool. - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md): Choose the people and work you need, with clear terms for legal advice, practical help and ongoing support. ### Handle a problem - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md): Get the right people involved, contain the breach and keep the reporting decisions clear. - [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim.md): Separate the complaint, the request for payment and any court action before deciding what help you need. - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md): Check the risk to people, then use the right reporting route and deadline. - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md): Most letters from the regulator have a clear next step, and a calm first week makes the rest easier. - [How much can the ICO fine you under UK GDPR?](https://theassurancedesk.com/guides/uk-gdpr-fines.md): The legal maximum is a ceiling, not a prediction of what a business will pay. ## Latest in data protection - [The ICO led our data protection citation snapshot](https://theassurancedesk.com/news/ai-answers-data-protection-sources-october-2026.md), 13 October 2026. The regulator appeared most often in our October answers to selected UK questions about data protection help. - [UK data protection: what changed in September 2026?](https://theassurancedesk.com/news/uk-data-protection-september-2026.md), 13 October 2026. A look back at the regulator’s new structure, TikTok’s withdrawn appeals and the debate about smart glasses. - [The ICO became the Information Commission on 30 September 2026](https://theassurancedesk.com/news/ico-becomes-the-information-commission.md), 29 September 2026. A board replaced a single commissioner at the top of the UK regulator, and its powers, its work and the ICO name carried on. ## The basics, explained In the UK, two laws set the rules for personal data: UK GDPR and the Data Protection Act 2018. They ask everyone responsible for personal data to use it fairly, lawfully and openly, and to keep it secure. The ICO is the regulator. The US has no national privacy law that covers every business, so some states have passed their own. ### What does UK data protection law ask of you? UK data protection law asks you to follow seven principles, pay the ICO a fee and deal with complaints. The rules come from two UK laws: UK GDPR and the Data Protection Act 2018. They apply to everyone responsible for using personal data, unless an exemption applies ([GOV.UK](https://www.gov.uk/data-protection), checked 29 September 2026). UK GDPR has seven principles. The last one, accountability, means you must be able to show that you follow the other six ([UK GDPR Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 29 September 2026). Every organisation that uses personal data must pay the ICO a data protection fee, unless it is exempt. Sole traders count as organisations here (the [ICO](https://ico.org.uk/for-organisations/data-protection-fee/), checked 29 September 2026). You also need a way for people to complain to you about how you use their data. You must acknowledge each complaint within 30 days (the [ICO](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/), checked 29 September 2026). **The seven principles, in plain words** - Use personal data lawfully, fairly and openly. - Collect it for a clear purpose, and reuse it only in ways that fit that purpose. - Collect only what you need. - Keep it accurate, and up to date where needed. - Keep it no longer than you need. - Keep it secure. - Be able to show that you do all of this. Article 5 of UK GDPR sets out seven principles, shown here in everyday words. Source: ICO guide to the data protection principles, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/ (checked 29 September 2026) ### Who is the regulator, and what has changed? The UK data protection regulator is the [Information Commission](/news/ico-becomes-the-information-commission), still known as the ICO. It took over the Information Commissioner's work on 30 September 2026 ([the ICO, 30 September 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/) and [the ICO, 15 September 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-governance-changes-confirmed-for-30-september-2026/), checked 2 October 2026). The other change is the Data (Use and Access) Act 2025 (UK), which updates UK GDPR and the Data Protection Act 2018 and does not replace them (the [ICO](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 29 September 2026). The Act's data protection changes came into force in stages, between June 2025 and June 2026 (the [ICO](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 29 September 2026). > "Most of the changes offer you an opportunity to do things differently, rather than needing you to make specific changes to comply with the law." > The ICO, on the Data (Use and Access) Act 2025 (UK), https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (checked 29 September 2026) ### Are you a controller or a processor? You are a controller under UK GDPR if you decide why and how personal data is used, and a processor if you use it on someone else's behalf, on their instructions (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 29 September 2026). A controller that uses a processor needs a binding contract, or a similar legal document, that says what the processor does and for how long ([UK GDPR Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28), checked 29 September 2026). **Controller and processor** - **Controller** - Decides why and how personal data is used - Is responsible for following UK GDPR - Must be able to show that it does - In the ICO's example, the gym - **Processor** - Uses personal data on the controller's behalf - Acts on the controller's instructions - Has more limited duties - Tells the controller about a breach without undue delay - In the ICO's example, the printing firm The ICO's own example: a gym sends its members invitations, and a printing firm addresses the envelopes. Source: ICO guidance on controllers and processors, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ (checked 29 September 2026); UK GDPR Article 33, legislation.gov.uk, https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026) ### Do you need a data protection officer? UK GDPR requires a data protection officer (DPO) in three cases only. You are a public body. Your main work is tracking people regularly on a large scale. Or your main work is handling sensitive or criminal offence data on a large scale ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026). Anyone else may appoint one by choice, and the same rules then apply. The officer can be on your staff or under a service contract. If you decide not to appoint, the ICO says it is a good idea to record that decision (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). The guide to [whether you need a DPO](/guides/do-you-need-a-dpo) takes each test in turn. The guide to [how DPO services are priced](/guides/how-dpo-and-data-protection-services-are-priced) explains how firms charge. **The three UK GDPR tests** Must you appoint a data protection officer? - You are a public body: for example, a state school or academy in England OR - Your main work is tracking people regularly, on a large scale: for example, a large retail website that tracks searches and purchases OR - Your main work is handling sensitive or criminal offence data, on a large scale: for example, a health insurer that holds health data on many people Yes, if any one applies. If none applies, it is your choice. Each test comes with an example from official guidance. Source: ICO guidance on data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026); GOV.UK, data protection officers in schools, https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers (checked 29 September 2026) ### What happens after a personal data breach in the UK? After a personal data breach in the UK, you contain it, judge the risk to people and record it. Under UK GDPR, you also report it to the ICO if people are likely to be at risk. You may send the ICO the details in stages (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 29 September 2026). A breach is not only a hack. It includes personal data that is lost, changed without permission or sent to the wrong person (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 29 September 2026). See [the first days after a breach](/best/post-breach). **The first steps after a breach** 1. Contain it: Stop the breach where you can and limit the harm. 2. Judge the risk: Judge how serious the effect on people could be, and how likely it is. 3. Report if needed: Tell the ICO without undue delay and, where feasible, within 72 hours, if people are likely to be at risk. 4. Tell the people affected: Do this without undue delay if the risk to them is high. 5. Record it: Log the facts, the effects and what you did, reported or not. What the ICO's guidance asks of an organisation once it knows about a breach. Source: ICO guide to personal data breaches, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026) ### How does the US handle data protection? US data protection rules come from federal and state sources. No single US law covers every business, so some states have written their own ([IAPP](https://iapp.org/news/a/secure-data-act-analysis-of-the-new-federal-privacy-bill), checked 29 September 2026). The California Consumer Privacy Act (CCPA) lets people find out what personal information a business collects about them, ask for it to be deleted or corrected, and opt out of its sale or sharing ([California Attorney General](https://oag.ca.gov/privacy/ccpa), checked 29 September 2026). **Where US privacy rules come from** - **Federal Trade Commission (FTC)**: The chief federal privacy enforcer since the 1970s - **State privacy laws**: 19 states had passed a general privacy law by January 2026 (counted by the IAPP, the International Association of Privacy Professionals) - **California**: Enforces the CCPA (the Attorney General and the California Privacy Protection Agency) - **State breach laws**: Every state requires notice of a breach involving personal information US privacy rules come from federal and state sources, not from one national law. Source: FTC, protecting consumer privacy and security, https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security (checked 29 September 2026); IAPP, US state privacy requirements as 2026 begins, January 2026, https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins (checked 29 September 2026); California Attorney General, CCPA, https://oag.ca.gov/privacy/ccpa (checked 29 September 2026); FTC, data breach response guide for business, https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business (checked 29 September 2026) ## Key dates for data protection - 25 May 2018, UK: Most of the Data Protection Act 2018 came into force. - 1 January 2023, US: New rights began in California: to correct personal information, and to limit the use of sensitive information. - 19 June 2025, UK: The Data (Use and Access) Act 2025 became law. - 5 February 2026, UK: Most of that Act's data protection changes came into force. - 19 June 2026, UK: The duty to handle data protection complaints came into force. - 30 September 2026, UK: The Information Commission took over the work of the Information Commissioner. The dates behind today's rules, in the UK and in California. Source: Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018, S.I. 2018/625, https://www.legislation.gov.uk/uksi/2018/625/made (checked 29 September 2026); California Attorney General, CCPA, https://oag.ca.gov/privacy/ccpa (checked 29 September 2026); Data (Use and Access) Act 2025 (UK), legislation.gov.uk, https://www.legislation.gov.uk/ukpga/2025/18/introduction (checked 29 September 2026); GOV.UK, Data (Use and Access) Act 2025 plans for commencement, https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement (checked 29 September 2026); Data (Use and Access) Act 2025 (UK), section 103, legislation.gov.uk, https://www.legislation.gov.uk/ukpga/2025/18/section/103 (checked 29 September 2026); UK commencement regulations, S.I. 2026/1015, https://www.legislation.gov.uk/uksi/2026/1015/made (checked 29 September 2026) ## Data protection in the UK and the US at a glance | Topic | UK | US | | --- | --- | --- | | The main law | UK GDPR and the Data Protection Act 2018 | No national law for every business. State laws, such as California's CCPA | | The regulator | The Information Commission (the ICO), its name since 30 September 2026 | The FTC at federal level. In California, the Attorney General and the California Privacy Protection Agency | | After a breach | Report to the ICO without undue delay and, where feasible, within 72 hours, if people are likely to be at risk | Every state has a law that requires notice of a breach involving personal information | | People's rights | To be told how data is used, to see it, to correct it and to have it erased, among others | Set state by state. In California, to know, delete, correct and opt out of sale or sharing | Source: GOV.UK, the UK's data protection legislation, https://www.gov.uk/data-protection (checked 29 September 2026); The ICO: ICO welcomes transition to new Information Commission, 30 September 2026, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026); UK GDPR Article 33, legislation.gov.uk, https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026); IAPP, SECURE Data Act analysis, April 2026, https://iapp.org/news/a/secure-data-act-analysis-of-the-new-federal-privacy-bill (checked 29 September 2026); FTC, protecting consumer privacy and security, https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security (checked 29 September 2026); FTC, data breach response guide for business, https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business (checked 29 September 2026); California Attorney General, CCPA, https://oag.ca.gov/privacy/ccpa (checked 29 September 2026) ## Your situation and provider lists - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment.md): The answer tells you whether the role is a legal duty or your own choice. - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach.md): The clock starts when you find out, so it helps to know the steps before you need them. - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider.md): Most of the work is paperwork: getting your records back and keeping breach cover in place. - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated.md): Your sector regulator and the data protection regulator can both ask about the same data. [Browse the provider directory](https://theassurancedesk.com/advisers.md) ## Words you will meet - [UK GDPR](https://theassurancedesk.com/glossary#uk-gdpr) - [Data (Use and Access) Act 2025 (DUAA)](https://theassurancedesk.com/glossary#data-use-and-access-act-2025) - [ICO](https://theassurancedesk.com/glossary#ico) - [Data protection officer (DPO)](https://theassurancedesk.com/glossary#data-protection-officer) - [DPO-as-a-service (outsourced DPO)](https://theassurancedesk.com/glossary#dpo-as-a-service) - [Special-category data](https://theassurancedesk.com/glossary#special-category-data) - [Personal data breach](https://theassurancedesk.com/glossary#personal-data-breach) - [72-hour rule](https://theassurancedesk.com/glossary#72-hour-rule) - [ROPA](https://theassurancedesk.com/glossary#ropa) - [Subject access request (SAR)](https://theassurancedesk.com/glossary#subject-access-request) - [DPIA](https://theassurancedesk.com/glossary#dpia) ## Sources - GOV.UK, the UK's data protection legislation: https://www.gov.uk/data-protection (checked 29 September 2026) - UK GDPR Article 5, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/5 (checked 29 September 2026) - UK GDPR Article 28, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/28 (checked 29 September 2026) - UK GDPR Article 33, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026) - UK GDPR Article 37, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 29 September 2026) - ICO guide to the data protection principles: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/ (checked 29 September 2026) - ICO, data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/ (checked 29 September 2026) - ICO, how to deal with data protection complaints: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ (checked 29 September 2026) - ICO, what the Data (Use and Access) Act 2025 means for organisations: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (checked 29 September 2026) - ICO, governance changes confirmed for 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-governance-changes-confirmed-for-30-september-2026/ (checked 29 September 2026) - The ICO: ICO welcomes transition to new Information Commission, 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026) - UK commencement regulations, S.I. 2026/1015: https://www.legislation.gov.uk/uksi/2026/1015/made (checked 29 September 2026) - ICO guidance on controllers and processors: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ (checked 29 September 2026) - ICO guidance on data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026) - GOV.UK, data protection officers in schools: https://www.gov.uk/guidance/data-protection-in-schools/role-of-data-protection-officers (checked 29 September 2026) - ICO guide to personal data breaches: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026) - IAPP, SECURE Data Act analysis, April 2026: https://iapp.org/news/a/secure-data-act-analysis-of-the-new-federal-privacy-bill (checked 29 September 2026) - IAPP, US state privacy requirements as 2026 begins, January 2026: https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins (checked 29 September 2026) - California Attorney General, CCPA: https://oag.ca.gov/privacy/ccpa (checked 29 September 2026) - FTC, protecting consumer privacy and security: https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security (checked 29 September 2026) - FTC, data breach response guide for business: https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business (checked 29 September 2026) - Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018, S.I. 2018/625: https://www.legislation.gov.uk/uksi/2018/625/made (checked 29 September 2026) - Data (Use and Access) Act 2025 (UK), legislation.gov.uk: https://www.legislation.gov.uk/ukpga/2025/18/introduction (checked 29 September 2026) - GOV.UK, Data (Use and Access) Act 2025 plans for commencement: https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement (checked 29 September 2026) - Data (Use and Access) Act 2025 (UK), section 103, legislation.gov.uk: https://www.legislation.gov.uk/ukpga/2025/18/section/103 (checked 29 September 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.