A recruitment agency onboards a new client and receives a spreadsheet of candidate details, including health data. Within hours, a question surfaces: under which lawful basis can we process this, and does the new complaints duty apply to us yet? That kind of practical pressure, not abstract regulation, is where UK data protection law actually lives.
UK GDPR and the Data Protection Act 2018: what sits where
Two pieces of legislation run in parallel. The UK General Data Protection Regulation (UK GDPR) sets out principles, lawful bases and individual rights. The Data Protection Act 2018 supplements it with exemptions, enforcement powers and specific rules for areas like law enforcement and intelligence services.
See also: UK construction law: Insights into dispute resolution
Confusing the two causes real problems. The Act contains provisions that modify how UK GDPR applies in practice, particularly around national security exemptions and immigration data. Treating the UK GDPR as the sole reference point means missing carve-outs that could either help or constrain your processing.
The Data (Use and Access) Act 2025 amends both instruments rather than replacing them. It received Royal Assent but is being brought into force in stages. Organisations cannot assume every provision is live simply because the Act exists. Each process needs checking against the specific commencement dates for the relevant sections.
You may also like: Divorce law reform in the UK: What you need to know
Recognised legitimate interests: a narrower gateway than it looks
One of the changes introduced by the 2025 Act is a recognised legitimate interests basis. On first reading, it sounds like a shortcut, a way to skip the balancing test that legitimate interests normally demands. It is not.
The new basis applies only to a closed list of specified purposes. These include crime prevention, safeguarding vulnerable individuals and emergency response. If your processing falls outside those categories, you still need to carry out the standard three-part legitimate interests assessment: purpose, necessity, and balance against the data subject’s rights.
We have already seen organisations misread this provision as a blanket permission for direct marketing or profiling. The recognised basis does not replace the balancing test for commercial processing. Getting this wrong exposes you to enforcement action, because the ICO will look at which basis you relied on and whether the statutory conditions were met.
Data protection complaints duty since June 2026
Since 19 June 2026, every controller, regardless of size, must provide an accessible way for individuals to make data protection complaints. The obligation breaks down into three concrete requirements:
- A clear, accessible mechanism for receiving complaints (a web form, email address or equivalent, not buried in small print)
- Acknowledgement within 30 days of receipt
- Appropriate steps to respond without undue delay after acknowledgement
This duty did not exist in the original UK GDPR framework. Smaller organisations that previously relied on informal handling now need a documented process. The 30-day acknowledgement window is a hard deadline, not a target. Missing it creates a compliance gap the ICO could investigate.
For organisations already running subject access request (SAR) workflows, folding complaints handling into the same triage system makes sense. The operational burden is real but manageable if you treat it as process design rather than a legal abstraction.
Territorial scope: the Clearview AI ruling and overseas processors
UK data protection law applies to organisations outside the UK when they process personal data of people in the UK. That principle existed on paper for years. The Upper Tribunal’s decision in Information Commissioner v Clearview AI Inc on 6 October 2025 gave it teeth.
The Tribunal allowed the ICO’s appeal, finding that Clearview AI, a US-based facial recognition company with no UK establishment, fell within the territorial scope of UK data protection law. The reasoning turned on the fact that Clearview processed data of UK residents and its service was accessible to UK clients.
Overseas businesses offering AI or data services to UK customers should treat this ruling as a compliance trigger. If your product ingests personal data of UK individuals, whether through scraping, API calls or client uploads, the UK GDPR almost certainly applies to you. Relying on the absence of a UK office is no longer a viable defence.
Practical compliance steps for UK organisations
Rather than listing generic best practices, here are the specific operational checks that matter most under the current framework:
- Map each processing activity to a lawful basis in Article 6 UK GDPR. Where you rely on legitimate interests, document the three-part test. Where you rely on the new recognised basis, confirm the processing falls within the specified purposes
- Audit your complaints mechanism against the June 2026 duty. Confirm it is genuinely accessible, that acknowledgement timelines are tracked, and that responses are logged
- Review contracts with overseas processors. If a processor is outside the UK and handles UK personal data, verify that appropriate safeguards (such as international data transfer mechanisms) are in place
- Check commencement dates for each provision of the Data (Use and Access) Act 2025 before relying on any new power or exemption it introduces
The ICO publishes guidance on adequacy decisions and international transfers. For organisations dealing with cross-border data flows, monitoring the ICO’s adequacy opinions is a recurring task, not a one-off exercise. Adequacy status can change, and relying on an outdated assumption about a country’s status creates transfer risk.
UK data protection law is not a single statute to read once and file away. The layered interaction between the UK GDPR, the Data Protection Act 2018 and the staged rollout of the 2025 Act means compliance is an ongoing process of checking which rules apply to which activity, and when. The organisations that handle this well are the ones that build it into operational routines rather than treating it as a legal department problem.
