Every data protection change in the Data (Use and Access) Act 2025 is now in force, and the last one, a legal duty to handle data protection complaints, took effect on 19 June 2026. The ICO's own summary is that most of the Act gives organisations new options rather than new obligations. For app and SaaS teams that is true, with four exceptions that need product work: a complaints route, changes to how cookie consent can work, safeguards around automated decisions, and a duty to consider children's needs.
This guide translates the Act into product and engineering decisions for UK apps and SaaS platforms. It covers the changes to UK GDPR, the Data Protection Act 2018 and PECR that affect commercial software. It is not legal advice, and it does not cover law enforcement processing, digital verification services, smart data schemes or the National Underground Asset Register.
What is the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 is a UK law that amends, but does not replace, the UK GDPR, the Data Protection Act 2018 and PECR. It relaxes some rules, such as certain cookies without consent and wider automated decision-making with safeguards, and adds duties, including handling data protection complaints and considering children's needs.
When did each change take effect?
| Date | What commenced |
|---|---|
| 19 June 2025 | Royal Assent; regulation-making powers in force automatically |
| 20 August 2025 | Stage 1: technical provisions and new statutory objectives for the ICO |
| 1 December 2025 | Most digital verification services measures |
| 5 February 2026 | The majority of data protection and privacy changes in Part 5, including UK GDPR and PECR amendments |
| 19 June 2026 | Duty on organisations to handle data protection complaints; ICO confirms all data protection provisions are in force |
Sources: GOV.UK commencement plan and the ICO's guidance for organisations, updated 19 June 2026.
The changes that affect app and SaaS products
| Change | What the law now allows or requires | What it means for your product |
|---|---|---|
| Data protection complaints | Organisations must help people complain, acknowledge complaints within 30 days and respond without undue delay | A visible complaint route, a tracked queue with a 30-day timer, and outcome messages |
| Cookies and similar technologies | New consent exceptions, including statistics to improve a service and website, subject to clear information and a simple, free way to object | Some analytics can move out of the consent banner; advertising and cross-site tracking still need consent |
| Automated decision-making | Significant decisions based solely on automated processing are allowed on any lawful basis with safeguards; stricter rules remain for special category data | Notice of the decision, a way to contest it and a route to human review |
| Recognised legitimate interests | A new lawful basis for listed purposes such as crime prevention and safeguarding, with no balancing test | Useful for fraud and abuse detection; document which listed interest you rely on |
| Subject access requests | Searches need only be reasonable and proportionate; the clock can stop while you ask for needed clarification | Export tooling plus a request status that can pause and resume |
| Children's data | Online services likely to be used by children must take their needs into account when designing processing | If you follow the Age Appropriate Design Code you should already comply; record the assessment |
| Scientific research | Commercial research can count as scientific research; broad consent to an area of research is allowed | Clearer ground for product analytics research programmes, with safeguards |
| International transfers | Transfers need protection "not materially lower" than UK law; assessed reasonably and proportionately | Your transfer risk assessment is now the statutory "data protection test" |
| PECR enforcement | PECR enforcement powers and fines aligned with the Data Protection Act 2018 | Cookie and marketing breaches now carry UK GDPR-scale penalty exposure |
Cookie banners: what can actually change
PECR still prohibits storing or accessing information on a user's device unless an exception applies. The Act keeps the existing exceptions, such as strictly necessary storage, and adds new ones (GOV.UK PEC Regulations factsheet). The most useful for SaaS is the statistical purposes exception: storage or access whose sole purpose is collecting statistics about how your service or website is used, with a view to improving it.
Two conditions come with it. You must tell users what you are doing, and you must give them a simple means of objecting, free of charge. The ICO accepts that an existing cookie banner or preference centre can provide that objection route (ICO: What are the exceptions?).
- Can usually move to "on with objection": first-party product analytics used only to improve your own service.
- Still needs consent: advertising pixels, retargeting, cross-site tracking, and analytics tools that use the data for their own purposes.
- Watch your EU users: these exceptions are UK law. If your app serves people in the EU, EU consent rules still apply to them, so many teams run region-aware consent rather than one global banner.
Automated decisions and AI features
Before the Act, significant decisions based solely on automated processing were broadly prohibited except in narrow cases. Articles 22A to 22D of the UK GDPR now allow them on a wider range of lawful bases, including legitimate interests, provided you give people information about the decision, let them make representations and contest it, and let them obtain human intervention. Special category data keeps tighter restrictions (GOV.UK UK GDPR and DPA factsheet).
If your product uses AI to approve, reject, price or rank people, for example credit, hiring, insurance or access decisions, build the safeguards into the interface: an explanation screen, a "request a human review" action, and an audit trail of the inputs to each decision. Our guide to UX for AI products covers the design patterns, and EU AI Act compliance for SaaS covers the parallel EU obligations if you sell into Europe.
The complaints duty: what to build
From 19 June 2026, organisations must take steps to help people make data protection complaints, such as providing an electronic complaint form, acknowledge complaints within 30 days, and respond without undue delay while keeping the complainant informed (ICO DUAA hub). For a software product that means:
- A "data protection complaint" option in your help centre, in-app support and privacy notice.
- A separate category in your ticketing system so these do not sit in the general support queue.
- An automatic acknowledgement and a visible timer against the 30-day limit.
- An owner, usually your data protection lead, and a record of the investigation and outcome.
- A reporting view so leadership can see volume, age and outcomes.
How to update your product for the Act
- Inventory your cookies and SDKs. Mark which exist only for first-party service statistics and which serve advertising or third parties.
- Redesign consent by region. Use the UK exceptions for UK users where they fit, keep consent where required, and give an easy objection route.
- Add the complaints route and workflow described above, and update the privacy notice to point to it.
- List every automated decision with legal or similarly significant effects, then add notice, contest and human review paths.
- Upgrade subject access tooling so requests can be paused for clarification and exported from all systems, including logs and support tools.
- Review children's use. If children are likely to use the service, document how their needs shaped your design.
- Re-run transfer assessments for suppliers and engineers outside the UK against the "not materially lower" test.
- Record your decisions. Where you rely on recognised legitimate interests or the new exceptions, write down why.
Much of this is ordinary product work if your platform was built with privacy controls from the start. If it was not, the same audit usually surfaces wider security gaps; our AI governance policy template is a useful companion for the AI parts.
Frequently asked questions
Is the Data (Use and Access) Act 2025 in force?
Yes. It received Royal Assent on 19 June 2025. Most data protection and privacy changes commenced on 5 February 2026, and the complaints handling duty commenced on 19 June 2026. The ICO confirmed on 19 June 2026 that all data protection provisions in the Act are now in force.
Does the Data (Use and Access) Act replace UK GDPR?
No. It amends the UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. Core principles, lawful bases, data subject rights and breach reporting under UK GDPR still apply, with the specific changes the Act introduces.
Do I still need a cookie banner under the new rules?
Usually yes. The Act lets you use some technologies without consent, such as first-party statistics to improve your service, but you must still tell users and give them a simple way to object. Advertising and third-party tracking still need consent, and EU users remain under EU consent rules.
What do organisations need to do about data protection complaints?
From 19 June 2026 you must help people make data protection complaints, for example with an electronic form, acknowledge each complaint within 30 days, investigate and respond without undue delay, and tell the person the outcome. The duty applies to all organisations that process personal data.
Can my app now make automated decisions about users?
More often than before. Significant solely automated decisions can rely on a wider range of lawful bases, including legitimate interests, if you provide safeguards: information about the decision, a way to make representations and contest it, and access to human intervention. Decisions based on special category data remain more restricted.
Key takeaways
- All data protection provisions of the Act are in force; the complaints duty started on 19 June 2026.
- First-party service statistics can often run without consent, with clear information and a simple objection route; ads and tracking still need consent.
- Automated decisions are allowed more widely, but only with notice, a way to contest and human review.
- Apps need a data protection complaints route with a 30-day acknowledgement timer.
- PECR penalties are now aligned with the Data Protection Act 2018, so cookie and marketing mistakes cost more.
Get a DUAA product review
If you run a UK app or SaaS platform and want the Act translated into a backlog, send us a link to your product. Our UK company, based at our London office at 2-7 Clerkenwell Green, EC1R 0DE, will review your consent setup, complaint and access request flows, and automated decisions, and return a prioritised list of engineering changes with estimates. Where a question needs a lawyer rather than an engineer, we will flag it. See how we build SaaS platforms for London companies.
Sources
- ICO: The DUAA, what does it mean for organisations? (updated 19 June 2026)
- GOV.UK: Data (Use and Access) Act 2025 plans for commencement
- GOV.UK: DUAA data protection and privacy changes
- GOV.UK: DUAA factsheet, PEC Regulations
- GOV.UK: DUAA factsheet, UK GDPR and DPA
- ICO: Storage and access technologies, what are the exceptions?
- legislation.gov.uk: Data (Use and Access) Act 2025