One Year On Marking The 12 Month Commencement Of The Data Use And Access Act

2026-06-23 · Source: ico.org.uk · Field: Legal & Regulatory — Compliance & Risk Management, Regulatory Affairs & Government Relations · Depth: Intermediate, quick

Summary

The Data Use and Access Act (DUAA) commenced on June 19, 2026, marking one year since it received Royal Assent. This legislation introduces significant changes for UK organizations and the public, aiming to foster innovation while protecting personal information and building trust. Over the past year, the Information Commissioner's Office (ICO) has focused on providing practical support, publishing new and updated guidance across 13 high-priority areas, and conducting 11 DUAA-related consultations that garnered over 300 responses. The Act also grants the ICO new powers, including compelling witness interviews, requesting reports from approved persons, and issuing fines up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR). Future plans include continued guidance publication and developing a new statutory code of practice on artificial intelligence and automated decision-making.

Key takeaway

Compliance Officers overseeing UK data operations should note the Data Use and Access Act's commencement. This requires reviewing your data protection practices. You must ensure compliance with updated guidance, especially regarding complaints handling and automated decision-making. Be aware of the ICO's new enforcement powers, including potential fines up to £17.5 million or 4% of global turnover under PECR. Proactively consult the ICO's guidance pipeline and engage in upcoming consultations to mitigate risks and maintain regulatory alignment.

Key insights

The DUAA's commencement empowers UK regulators with new tools and guidance to balance data innovation with privacy protection.

Principles

• Regulatory certainty is prioritized through guidance.
• Enforcement powers are reserved for serious cases.
• Risk-based approaches guide future regulatory focus.

Method

The ICO develops guidance by identifying high-priority areas, conducting consultations to gather insights, and then publishing updated resources to provide regulatory certainty.

In practice

• Consult guidance pipeline for updates.
• Engage in DUAA-related consultations.
• Prepare for new data protection processes.

Topics

• Data Use and Access Act
• UK Data Regulation
• ICO Enforcement Powers
• Data Protection Compliance
• Automated Decision-Making
• AI Governance

Best for: CTO, VP of Engineering/Data, Executive, Legal Professional, Consultant, Director of AI/ML

Related on AIssential

• Blog Post: GDPR Anniversary – 10 Key Developments — GDPR is evolving through legislative reform, intensifying enforcement, and new regulatory guidance, demanding continuous compliance adaptation.
• Ico Response To Government On Safe Ai Powered Innovation — The ICO is establishing regulatory frameworks and guidance to ensure safe, trustworthy AI innovation and data protection compliance in the UK.
• What the X Fine Reveals About Data Access Under Article 40 of the Digital Services Act — The EU's DSA Article 40.12 mandates broad, free, and independent researcher access to public platform data.
• The €7.1 Billion Reckoning: GDPR Enforcement at the 2026 Midpoint — GDPR enforcement is compounding, shifting to operational failures in AI, consent, and vendor management, with maximum penalties for Article 5 violations.
• LGBT Q&A: What Data Are Companies in the UK Collecting When Verifying My Age? — UK age verification mandates pose significant privacy risks due to diverse data collection methods and retention practices.
• EFF and Allies: X’s FTC Petition to Waive Privacy Violation Order Should be Rejected — Corporate name changes or leadership rotations do not dissolve regulatory privacy obligations, especially with ongoing data misuse.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by ico.org.uk.