UK data law reforms are in force (Data (Use and Access) Act 2025)

Effective date: 5 February 2026. Last checked: 12 November 2026.

What changed

Most of the data protection reforms in the Data (Use and Access) Act 2025 took effect on 5 February 2026, and the ICO has since confirmed that all of the Act's data protection provisions are in force. The headline changes for growing businesses:

• Automated decisions. The old Article 22 of the UK GDPR was replaced with new Articles 22A to 22D. Significant decisions made solely by automated means are now allowed on a wider range of lawful bases, provided safeguards are in place: telling people, letting them make representations, and offering human review.
• Recognised legitimate interests. A new lawful basis for a short list of purposes, such as crime prevention and safeguarding, without the usual balancing test.
• Cookies and similar technologies. More low-risk uses, such as some analytics for improving a website, no longer need consent, as long as people are told and can object.

Who it affects

Every UK business that collects enquiries, keeps a CRM, uses analytics or lets software make decisions about customers.

What to do

Review your privacy notice, check which decisions your systems make automatically, and confirm your cookie banner still matches what you actually use. This is general information, not legal advice.