On February 5, 2026, the UK brought the main data protection changes in Part 5 of the Data (Use and Access) Act 2025 (DUAA) into force, updating the UK’s data protection and e-privacy framework. Key reforms include a statutory definition of scientific research, recognized legitimate interests as a lawful basis for processing, changes to automated decision-making, clarified data subject access request rules, updated international transfer rules, and revised cookie consent requirements.
