The UK’s Data Use and Access Act 2025 (DUAA) began implementing key data-protection reforms on February 5, 2026, modernizing parts of the UK GDPR and Privacy and Electronic Communications Regulations. Changes include new protections for children’s data, a legal basis for “recognized legitimate interests,” updated data access request rules, expanded automated decision-making provisions with safeguards, and revised cookie consent requirements. Other reforms, like a complaints-process mandate, will follow later in 2026.
