The Information Commissioner’s Office has stepped up to the plate following the Data (Use & Access) Act 2025 receiving Royal Assent – just seven days after it was passed by both Houses of Parliament – by publishing a raft of new guidance for businesses.
The legislation updates key aspects of data protection law, with the aim of making it easier for UK firms to protect people’s personal information while growing and innovating their products and services.
Changes to the law include clarifying how personal information can be used for research; lifting restrictions on some automated decision making; setting out how to use some cookies without consent; allowing charities to send people email marketing without consent in certain circumstances; requiring organisations to have a data protection complaints procedure; and introducing a new lawful basis of recognised legitimate interests.
The Act also provides the ICO with new powers, including the ability to compel witnesses to attend interviews, request technical reports, and bring the penalties for breaches of PECR in line with GDPR, opening up the prospect of fines of up to £17.5m or 4% of global turnover.
It has now published information to support organisations and the public as these changes are introduced. This includes an outline of what the Act means for organisations; an outline of what the Act means for law enforcement agencies; a detailed summary of the changes for data protection experts; a new and planned guidance webpage setting out what guidance to expect and when; an outline of how the ICO will continue its regulatory work as the Act is implemented, and, finally, a guide for the public on how the Act will affect them.
Information Commissioner John Edwards said: “The Act gives organisations using personal information new and better opportunities to innovate and grow in the UK, and further enhances our ability to balance innovation and economic growth with strong protections for people’s rights.
“Today we’ve published a catalogue of resources to help explain what this new legislation means for businesses. Over the coming months we will launch new guidance, open consultations, and provide practical tools to help embed the Act’s principles into everyday operations. Our goal is to ensure that data can be used confidently and responsibly to deliver better services, drive economic growth, and uphold public trust.”
Related stories
Four years in the making, UK data reforms are passed
Peers stand firm as data reforms ‘ping pong’ continues
Ministers invoke 1678 law to block AI copyright protest
Data reforms hit as Lords mount revolt over AI copyright
Data reforms inch closer but Govt fails to defuse AI row
‘Henry VIII’ clauses threaten to derail data reform bill
Lords on alert over EU deal as Data Bill concerns grow
Privacy group blasts AI free-for-all in Data Bill ‘rehash’
Labour vows to put tech and AI at the heart of economy
Tories ditch new data reforms Bill in election manifesto
DMA calls on main parties to prioritise data, tech and AI
Cheers and boos as data reforms Bill ends up in the bin
Data reforms Bill ‘doomed’ as General Election is called
