Legal & Contracting in the United Kingdom

Full guide · Source-checked research100% of statements checked against a source145 checked against an official source0 checked against a secondary sourceChecked 2026-10-19Not yet professionally reviewed

• The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations rather than replacing them.

  UK-wide. Commenced in four stages between August 2025 and 2026.Department for Science, Innovation and Technology · checked 2026-10-18

• Most of the Act's Part 5 data protection and privacy changes came into force on 5 February 2026, including recognised legitimate interests, the new automated decision-making rules, the international transfer changes, the cookie exceptions and the PECR enforcement changes.

  Brought into force by regulation 2 of SI 2026/82 so far as not already in force; transitional provisions limit some changes for conduct before commencement.legislation.gov.uk (The National Archives) · checked 2026-10-18

• The new right for data subjects to complain directly to controllers (section 103 of the Act) came into force on 19 June 2026.

  Applies to controllers subject to the UK GDPR and Data Protection Act 2018.legislation.gov.uk (The National Archives) · checked 2026-10-18

• Controllers must have a process for handling data protection complaints made directly to them, acknowledge a complaint within 30 days and take appropriate steps to respond.

  The Secretary of State may later require controllers to report complaint numbers to the regulator.Department for Science, Innovation and Technology · checked 2026-10-18

• For transfers outside the UK, the test is now whether protection in the destination is not materially lower than under UK law, and exporters relying on safeguards such as standard clauses must apply that test acting reasonably and proportionately.

  Applies to transfers approved by regulations (formerly adequacy) and to transfers subject to appropriate safeguards. The four-year adequacy review cycle was removed.Department for Science, Innovation and Technology · checked 2026-10-18

• A transfer is a restricted transfer only if the UK GDPR applies to the processing, the sender initiates the transfer or makes UK-held data accessible abroad (including remote access), and the receiver is a separate legal entity; it must then be covered by transfer regulations, appropriate safeguards or an exception.

  Sending data to the organisation's own employees abroad within the same legal entity is not a restricted transfer.Information Commissioner's Office · checked 2026-10-18

• Enforcement powers and fines under the Privacy and Electronic Communications Regulations (marketing, cookies) are aligned with those under the Data Protection Act 2018.

  Direct marketing breaches can be fined even if the call or message does not reach its recipient.Department for Science, Innovation and Technology · checked 2026-10-18

• Consent is no longer needed for cookies used only to collect statistics on how an organisation's own online service is used in order to improve it; other non-essential cookies still need consent.

  Exceptions now sit in new Schedule A1 to PECR; the Secretary of State can add or amend exceptions by regulations.Department for Science, Innovation and Technology · checked 2026-10-18

Read the full guide: Data protection, transfers and cyber · Intellectual property and brand protection · Deals, investment screening and merger control · Bribery, fraud, sanctions and compliance · Courts, arbitration, mediation and enforcement