# Is UK GDPR changing in 2026? The law has changed, but your old data protection duties have not disappeared. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. **The short answer.** Yes. The Data (Use and Access) Act 2025 changes UK GDPR rather than replacing it. The ICO’s update on 19 June 2026 confirmed that all the Act’s data protection provisions were in force ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ## In this series - [Automated decisions: what UK GDPR now requires](https://theassurancedesk.com/guides/automated-decisions-uk-gdpr.md) ## Has the new Act replaced UK GDPR? No. It amends UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. Those last rules cover areas such as cookies. Think of changes to the rulebook, rather than a blank page ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). The ICO says most changes offer a choice to work differently. They do not all require a new process. But there are duties to check, including how you handle complaints and the needs of children ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ## What has changed for UK organisations? Start with the parts of your work that use personal information. The table shows where to look. It is a short guide to the changes, not permission to skip the conditions attached to them ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). **The change and the question to ask** | Area | What has changed | What to check | | --- | --- | --- | | Complaints | Help people complain. Acknowledge within 30 days and respond without undue delay. | Can someone find your process and use it easily? | | Access requests | Searches must be reasonable and proportionate. | Can you explain how you searched? | | Cookies | Some statistics and website function cookies can be used without consent. | Does each cookie meet the conditions? | | Automated decisions | Wider grounds are available, with safeguards. | Does the decision use special category data, which remains more protected? | | Children | Online services likely to be used by children must consider their needs. | How do those needs affect your use of data? | Source: ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?, https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (checked 7 October 2026) ## Do complaints need a reply within 30 days? You must acknowledge a data protection complaint within 30 days. You must also respond without undue delay. Acknowledging a complaint means saying you have received it. That is different from giving a full answer ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). You must take steps to help people make a complaint. The ICO gives an electronic form as an example. Check that your process tells people how to raise a concern and gets it to someone who can act ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). **Make the complaint easy to follow** 1. Make it easy to complain: Give people a clear route to raise a concern. 2. Acknowledge it: Confirm receipt within 30 days. 3. Respond: Give a response without undue delay. The acknowledgement and the response are separate steps. Source: ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?, https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (checked 7 October 2026) ## Can you stop asking for cookie consent? Not as a blanket change. The new options cover some cookies used for statistics or website functions. Check what each cookie does and whether the relevant conditions are met before changing how you ask for consent ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ## What about AI decisions and legitimate interests? The wider options for significant automated decisions still need safeguards. The ICO says this change does not apply to special category data, which has more protection. It is not a general permission to let software make every decision about a person ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). For some listed uses, such as protecting public security, a new recognised legitimate interests route removes the balancing step. That step weighs the benefit of using data against the impact on people. This is a specific route, not the removal of that check for every use of data ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ## What to do 1. Check how people can make a data protection complaint ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). 2. Check who acknowledges complaints and who handles the response ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). 3. Review any planned use of the new cookie or automated decision options against their conditions ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). 4. If children are likely to use your online service, check how their needs are considered ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ## Common questions ### Is this a new EU GDPR law? This guide covers the UK changes made by the Data (Use and Access) Act 2025 to UK GDPR and related UK rules ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ### Are the data protection changes still waiting to start? No. The ICO’s 19 June 2026 update confirmed that all the Act’s data protection provisions were in force ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ### Does every business need to change every process? No. The ICO says most changes offer options. Check which changes affect your work, including the duties around complaints ([ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), checked 7 October 2026). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [How does the UK regulate AI?](https://theassurancedesk.com/guides/uk-ai-regulation.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) - [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md) ## Sources - ICO, The Data Use and Access Act 2025 (DUAA), what does it mean for organisations?: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.