The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and has been rolling out in stages ever since. By autumn 2026, several provisions that reshape cookie consent, complaint handling, and automated decision-making are already live. For organisations that also serve EU customers, these reforms raise a pointed question: can a single privacy framework still cover both jurisdictions?
Data Use and Access Act 2025: what actually changed and when
The reforms did not land on a single date. Provisions took effect in stages, which means the obligations that applied in early 2026 differ from those enforceable now. Treating the Act as one event is a compliance risk in itself.
Related reading: Brexit aftermath: economic implications for UK businesses in 2026
Since 19 June 2026, controllers must maintain a formal complaint-handling process and acknowledge any data-protection complaint within 30 days. That deadline is new. Before this provision, the UK GDPR required organisations to respond to data subject access requests (DSARs) within a calendar month, but complaints sat in a grey area where the ICO encouraged good practice without a statutory backstop.
The Act also widens the scope for decisions based solely on automated processing. Certain automated decisions that were previously restricted are now more permissible, though safeguards for individuals remain in place. Organisations relying on algorithmic screening for recruitment, credit scoring, or insurance underwriting need to map exactly which safeguards still apply to their specific use case.
Recommended read: Legal reforms affecting UK property market in 2026
Cookie consent exemptions under UK law
One of the more discussed changes is the introduction of limited cookie-consent exemptions. Analytics cookies that meet defined criteria may no longer require prior consent under UK rules. For website operators, this could mean fewer banner clicks, but it does not mean banners disappear entirely. Cookies used for advertising, profiling, or cross-site tracking still require consent.
The practical effect is a split: your analytics setup might be exempt under UK law while remaining fully consent-dependent under the EU ePrivacy Directive. Running one cookie configuration across both markets is no longer straightforward.
UK and EU privacy compliance: one policy or two after 2026
This is where the reforms bite hardest for businesses operating across both markets. The UK Act introduces a recognised-legitimate-interests basis that has no equivalent in the EU GDPR. Under EU rules, every claim of legitimate interest must pass a balancing test. The UK version pre-approves certain categories of processing, removing the need for that case-by-case assessment.
That divergence alone makes a unified privacy policy risky. A policy drafted to UK standards might assert legitimate interest for processing that the EU framework still treats as requiring explicit consent or a full balancing exercise. Regulators on either side would read the same document differently.
Cookie banners: where the gap widens
Cookie configuration is the most visible friction point. Consider a business with visitors from both the UK and the EU:
- Under UK law, certain first-party analytics cookies may now be set without prior consent, provided they meet the exemption criteria in the Act.
- Under the EU ePrivacy Directive and GDPR, those same cookies still require informed, freely given consent before being placed on the user’s device.
- A single cookie banner that applies UK-exempt settings to EU visitors would breach EU rules. A banner that applies EU-strict settings universally would ignore the UK exemptions the business is entitled to use.
The only reliable approach is geo-differentiated cookie consent, serving different banner logic based on the visitor’s location. That requires technical investment in consent management platforms (CMPs) capable of jurisdiction-level configuration.
International data transfers still supported, for now
On the transfer side, the EU renewed its adequacy decisions for the UK, meaning personal data can still flow from the EU to the UK without supplementary safeguards. That renewal removed one source of uncertainty, but adequacy is not permanent. It is reviewed periodically, and further UK divergence from EU standards could put future renewals at risk.
Businesses relying on adequacy should monitor the gap between UK and EU frameworks. If the UK continues to loosen consent requirements or expand automated-processing permissions in ways the EU does not, adequacy reviews become more contentious.
ICO enforcement and the complaint-handling duty in practice
The ICO has signalled increased enforcement activity, and the new statutory complaint-handling duty gives it a concrete metric to assess. Acknowledging a complaint within 30 days is a floor, not a ceiling. Organisations that treat it as a tick-box exercise risk exactly the kind of regulatory scrutiny the provision was designed to enable.
What the duty requires in practice:
- A documented complaints procedure that is accessible to data subjects, not buried in a privacy policy footer.
- A mechanism to log, track, and escalate complaints within the 30-day acknowledgement window.
- Evidence that complaints are actually resolved or escalated, not merely acknowledged and shelved.
For smaller organisations, this may mean designating a specific individual or team to handle complaints, even if a full-time Data Protection Officer is not required. The ICO’s ability to audit complaint-handling records makes this a practical compliance risk, not a theoretical one.
Automated decision-making: expanded permissions with unresolved edges
The Act’s changes to automated decision-making are less headline-grabbing than cookie reform but arguably more consequential. By making certain solely automated decisions more permissible, the UK framework moves away from the EU GDPR’s default position, which treats such decisions with suspicion unless specific conditions are met.
The safeguards that remain, including the right to obtain human intervention and to contest the decision, are preserved. What has changed is the threshold for when those safeguards are triggered. Organisations using automated systems need to reassess whether their current processes still qualify as “solely automated” under the revised definitions, and whether the applicable safeguards match the ones they have documented.
Guidance from the ICO on exactly which categories of automated processing benefit from the relaxed rules has not yet fully crystallised. Organisations acting before detailed ICO guidance is published are making compliance decisions based on legislative text alone, which carries a degree of interpretive risk that larger firms may absorb but smaller ones may not.
The divergence between UK and EU approaches to automated decisions also complicates cross-border operations. A decision that is lawful under the UK’s expanded permissions might still require explicit consent or additional safeguards under EU GDPR Article 22. Dual-market businesses cannot assume that UK-compliant automation passes EU scrutiny.
UK privacy law in 2026 is no longer a near-copy of the EU framework. The staged rollout of the Data (Use and Access) Act means obligations are still bedding in, and the ICO’s enforcement posture will shape how strictly the new rules are applied. For organisations operating solely in the UK, the reforms offer some genuine simplification. For those straddling the UK and EU, the era of one privacy policy fitting both markets is, for most practical purposes, over.
