The Assurance Desk
Has the new Act replaced UK GDPR?
No. It amends UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. Those last rules cover areas such as cookies. Think of changes to the rulebook, rather than a blank page.
The ICO says most changes offer a choice to work differently. They do not all require a new process. But there are duties to check, including how you handle complaints and the needs of children.
What has changed for UK organisations?
Start with the parts of your work that use personal information. The table shows where to look. It is a short guide to the changes, not permission to skip the conditions attached to them.
| Area | What has changed | What to check |
|---|---|---|
| Complaints | Help people complain. Acknowledge within 30 days and respond without undue delay. | Can someone find your process and use it easily? |
| Access requests | Searches must be reasonable and proportionate. | Can you explain how you searched? |
| Cookies | Some statistics and website function cookies can be used without consent. | Does each cookie meet the conditions? |
| Automated decisions | Wider grounds are available, with safeguards. | Does the decision use special category data, which remains more protected? |
| Children | Online services likely to be used by children must consider their needs. | How do those needs affect your use of data? |
Do complaints need a reply within 30 days?
You must acknowledge a data protection complaint within 30 days. You must also respond without undue delay. Acknowledging a complaint means saying you have received it. That is different from giving a full answer.
You must take steps to help people make a complaint. The ICO gives an electronic form as an example. Check that your process tells people how to raise a concern and gets it to someone who can act.
Make the complaint easy to follow
- Make it easy to complain Give people a clear route to raise a concern.
- Acknowledge it Confirm receipt within 30 days.
- Respond Give a response without undue delay.
Can you stop asking for cookie consent?
Not as a blanket change. The new options cover some cookies used for statistics or website functions. Check what each cookie does and whether the relevant conditions are met before changing how you ask for consent.
What about AI decisions and legitimate interests?
The wider options for significant automated decisions still need safeguards. The ICO says this change does not apply to special category data, which has more protection. It is not a general permission to let software make every decision about a person.
For some listed uses, such as protecting public security, a new recognised legitimate interests route removes the balancing step. That step weighs the benefit of using data against the impact on people. This is a specific route, not the removal of that check for every use of data.
What to do
- Check how people can make a data protection complaint.
- Check who acknowledges complaints and who handles the response.
- Review any planned use of the new cookie or automated decision options against their conditions.
- If children are likely to use your online service, check how their needs are considered.
Common questions
Is this a new EU GDPR law?
This guide covers the UK changes made by the Data (Use and Access) Act 2025 to UK GDPR and related UK rules.
Are the data protection changes still waiting to start?
No. The ICO’s 19 June 2026 update confirmed that all the Act’s data protection provisions were in force.
Does every business need to change every process?
No. The ICO says most changes offer options. Check which changes affect your work, including the duties around complaints.
Where next
Sources
- ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?, checked 7 October 2026
This is an independent editorial guide, not legal advice.