As of 19 June 2026, all of the data protection provisions in the Data (Use and Access) Act 2025 are now in force. The Information Commissioner's Office (ICO) has updated its guidance for organisations on the Act accordingly. The guidance now includes an overview of new and updated ICO guidance to support organisations, as well as a new section on the ICO's powers.
The Act makes changes to data protection law in order to promote innovation and economic growth and make things easier for organisations, whilst still protecting individuals and their rights. The ICO states that most of the changes offer organisations an opportunity to do things differently, rather than requiring specific changes to comply with the law.
The guidance explains what data protection laws have changed, and how the Act might help organisations to innovate and make things easier for them. Guidance is also provided on the new requirements for online services that are likely to be used by children, and the steps organisations must take to help people who wish to complain about how their personal information is used.
The ICO also provides a detailed summary of the changes the Act makes to data protection law that may affect organisations using personal information. This is aimed at data protection experts, including Data Protection Officers and people with specific data protection responsibilities.
The ICO will continue updating its guidance over time, prioritising the areas of greatest impact.
