WONE Global's guide to United Kingdom records these changes under data protection. Each statement below has been checked against the source it links to.
Enforcement powers and fines under the Privacy and Electronic Communications Regulations (marketing, cookies) are aligned with those under the Data Protection Act 2018.
Direct marketing breaches can be fined even if the call or message does not reach its recipient.
Department for Science, Innovation and Technology · Data (Use and Access) Act factsheet: ICO ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Consent is no longer needed for cookies used only to collect statistics on how an organisation's own online service is used in order to improve it; other non-essential cookies still need consent.
Exceptions now sit in new Schedule A1 to PECR; the Secretary of State can add or amend exceptions by regulations.
Department for Science, Innovation and Technology · Data (Use and Access) Act factsheet: PEC Regulations ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
For transfers outside the UK, the test is now whether protection in the destination is not materially lower than under UK law, and exporters relying on safeguards such as standard clauses must apply that test acting reasonably and proportionately.
Applies to transfers approved by regulations (formerly adequacy) and to transfers subject to appropriate safeguards. The four-year adequacy review cycle was removed.
Department for Science, Innovation and Technology · Data (Use and Access) Act factsheet: UK GDPR and DPA ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Most of the Act's Part 5 data protection and privacy changes came into force on 5 February 2026, including recognised legitimate interests, the new automated decision-making rules, the international transfer changes, the cookie exceptions and the PECR enforcement changes.
Brought into force by regulation 2 of SI 2026/82 so far as not already in force; transitional provisions limit some changes for conduct before commencement.
legislation.gov.uk (The National Archives) · The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
This is a summary of the rule as published, not advice on how it applies to you. The WONE Global Partner for this service in United Kingdom can advise on that.
