Last year’s Data (Use and Access) Act 2025 (‘DUAA’) updated several data protection law provisions (and we’ve already written a short article with a summary overview of some important changes)
Regulations made on 29th January 2026 clarified the dates on which these changes come into force.
Last Friday the Information Commissioner’s Office (ICO) published a statement on the commencement dates. (Also gov.uk updated where they summarise the government’s plans for bringing these provisions into force)
From 5 February 2026 onwards: for charities
Section 114 of the DUAA now allows charities to send ‘direct marketing’ communications (which includes fundraising) by electronic messages (e.g. email) to individuals in cases where all of the following apply:
- The sole purpose is to further one or more of the charity’s purposes.
- The charity obtained the individual’s contact details in the course of the individual expressing an interest in the charity’s purpose(s) or offering or providing support to further one or more of those purposes.
- Individuals are presented with a simple means of refusing the use of their contact details for the purposes of direct marketing at the time their contact details are collected and in every subsequent communication.
This change brings the position for charities into alignment with the position for commercial businesses, able to rely on the ‘soft opt-in’ rule for several years. It will enable charities to contact existing supporters more easily for future fundraising.
The ICO website provides guidance for charities who plan changing how they operate to take advantage of this important change.
From 5 February 2026 onwards: for all organisations
Section 70 of DUAA introduced “recognised legitimate interest” as a new lawful basis , covering public interest purposes, such as responding to an emergency, investigating crime, and safeguarding vulnerable individuals. The ICO has concluded pubic consultation on guidance relating to this and announced that it will be published before end of Winter 2026.
Section 76 of DUAA revised time limits for organisations responding to subject access requests (often called SAR or DSAR) and specified information organisations are required to provide when responding formally to those. Those changes reflected what was contained in ICO guidance already, and so organisations who have been familiar with it and followed it won’t need to make changes to how they handle SARs/DSARs. Comprehensive ICO guidance on handling DSARs is available online.
From 5 February 2026 onwards: for all organisations: cookies
Automated technologies that store information on an individual’s equipment are commonly known as ‘cookies’, for example a file downloaded onto your computer when you visit a website.
Section 112 (alongside Schedule 12) of the DUAA is now in force.
This creates new exceptions to the legal ban on storing information (or accessing any information stored) on equipment of individuals without their consent.
The current exceptions remain as before: cookies are permitted:
- If it is for the sole purpose of transmitting a communication over an electronic communications network.
- If strictly necessary to provide an information society service requested by the user.
Schedule 1A helpfully now provides a non-exhaustive list of examples of such ‘strictly necessary cookies’ which will be useful to website service providers, for example.
In addition, Schedule 1A adds the following new exceptions, with cookies permitted:
- To collect statistical information to improve the service.
- For functional purposes, that is, the way in which the information society service (the website) is displayed on a device.
- Where the sole purpose is to locate the geographical position of a subscriber or user in response to their emergency communication.
In relation to the first of those two new exceptions, the website operator must, however, free of charge –
- provide clear and comprehensive information about the purpose of the tracking and
- a new right to opt out.
In addition, Schedule 12 changes ways by which a subscriber or user may signify their consent to cookies. Now this includes:
- Amending or setting controls on the internet browser which the subscriber or user uses.
- Using another application or programme.
The Secretary of State now has power granted by the DUAA to further amend the exceptions (without having to once again through the process of a new law getting approved by Parliament).
Presently the ICO is redrafting guidance on these automated technologies, having concluded a consultation process. (In its draft form, it contained a new chapter on changes and the new requirements). It also recently invited the public and organisations to share views on its current approach to enforcement and taking regulatory action in relation to cookies and the applicable legal requirements for consent, specifically in the context of online advertising – and likely further guidance on that topic is coming soon.
Final important change on 19th June 2026: new ‘right to complain’ given to individuals
The new Regulations has confirmed the date when remaining provisions come into force, and one of the most significant changes is that individuals have a new right to complain directly to organisations about data protection compliance (section 103 and Schedule 10 of the 2025 Act).
The ICO has concluded public consultation on this change and will publish finalised complaints guidance for organisation before end of Winter 2026.
Individuals continue to have a right to complain to the regulator (ICO, who later this year will be renamed as the Information Commission (IC)) but will now be required to first submit a complaint to the organisation before the regulator will consider it.
If you have any questions on any of the issues raised in the above article, please contact Sean Morris.