The Data (Use and Access) Act 2025 amends, rather than replaces, the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. Most changes give practices more flexibility, but one is a new duty: since 19 June 2026 every controller must make it easy to complain about its use of personal data, acknowledge a complaint within 30 days and deal with it without undue delay. Practices should also update their subject access procedures, privacy notices, website cookie settings and any use of automated decisions.

What is the Act and when did it take effect?

The Act received Royal Assent on 19 June 2025. The ICO describes it as updating data protection law to promote innovation and growth and make things easier for organisations while still protecting people’s rights, and says it amends but does not replace the UK GDPR, the Data Protection Act 2018 and PECR. The government brought it in by stages. The majority of the data protection and privacy provisions came into force on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, and the ICO confirmed that all outstanding provisions were in force from 19 June 2026.

The ICO’s summary is that most of the changes offer an opportunity to do things differently, rather than requiring specific changes. For an accountancy practice the exception is complaints handling, which every firm must now have in place.

What is the new duty to handle data protection complaints?

Section 103 of the Act inserted section 164A into the Data Protection Act 2018. A data subject may complain to a controller if they consider their personal data has been handled in breach of the UK GDPR. The controller must facilitate complaints, for example by providing a complaint form that can be completed electronically and by other means, and must acknowledge receipt within 30 days of receiving the complaint. It must then take appropriate steps to respond without undue delay, including making enquiries into the subject of the complaint and keeping the complainant informed of progress, and must tell them the outcome. The provision came fully into force on 19 June 2026.

A new section 164B also allows the government to make regulations requiring controllers to report the number of complaints they receive to the regulator, so it is sensible to log every data protection complaint from the start.

For a practice this means a clear route for complaints in its privacy notice and on its website, a named person who owns them, a 30 day acknowledgement deadline in the diary and a written outcome. It can sit alongside the firm’s existing client complaints procedure but should recognise that the complainant may be a former client, a client’s employee or a member of staff.

What changes for subject access requests?

The Act makes clear that an organisation only has to carry out reasonable and proportionate searches when responding to a subject access request. It also confirms that the time limit starts when the organisation receives the request, any information requested to confirm the requester’s identity, or a fee where one may be charged for a manifestly unfounded or excessive request. And it introduces a power to “stop the clock”: where clarification is reasonably required to respond, the time limit is paused until the clarification arrives, provided the controller can show that it was needed.

These are helpful for practices that hold years of email and file notes, but they need to be written into the procedure so staff apply them consistently. The full process is in handling subject access requests in a practice.

What does the new recognised legitimate interests basis offer?

The Act adds a new lawful basis covering a list of “recognised legitimate interests” set out in an annex inserted into the UK GDPR. A necessity test still applies, but there is no balancing test of the firm’s interests against the individual’s. The Act also adds examples to the ordinary legitimate interests basis: direct marketing, intra group transfers for administrative purposes and ensuring the security of network and information systems.

For most client work the lawful basis does not change. The new basis is most likely to be relevant when a practice discloses information to the police or another public body; see lawful basis for client data.

What changes for the firm’s website and marketing?

The ICO says the Act allows some types of cookies to be set without consent, such as those used to collect information for statistical purposes and to improve the functionality of a website. A practice using basic website analytics should review its cookie banner against the ICO’s updated guidance on storage and access technologies rather than assume the old rules still apply.

On enforcement, the Act brings the ICO’s powers under PECR into line with the UK GDPR, so that enforcement mechanisms and penalties are the same in most cases. That makes the email and text marketing rules more expensive to break. The rules themselves are covered in email marketing rules under PECR.

Does the Act change the rules on automated decisions and AI tools?

Yes. Before the Act, significant decisions based solely on automated processing were tightly restricted. The ICO explains that the Act opens up the full range of lawful bases, apart from recognised legitimate interests, provided safeguards are in place: the person must be told about the decision, be able to make representations, obtain human intervention and contest it. Special category data remains more tightly restricted. A decision is solely automated if there is no meaningful human involvement.

A practice using software to accept or reject prospective clients on risk scores, or to make automatic decisions about staff, should check whether a person genuinely reviews the outcome and document the safeguards. See using AI in accountancy practice.

Who is the regulator now?

The Act replaced the office of Information Commissioner with the Information Commission, a body corporate with a board. The government confirmed that the Information Commission took over the ICO’s functions on 30 September 2026, and the ICO has said it will continue to be known as the ICO. The ICO also has new investigatory powers under the Act, including the ability to compel a witness to attend an interview and to request reports from approved persons.

What should a practice update now?

  1. Add a data protection complaints route to the privacy notice and website, with an electronic form or email address.
  2. Set up a complaints log with the 30 day acknowledgement date for each complaint.
  3. Revise the subject access procedure for reasonable and proportionate searches and stopping the clock.
  4. Review website cookies against the new exemptions.
  5. Check any automated client acceptance or staff tools for meaningful human involvement.
  6. Update references from “Information Commissioner” to the Information Commission where documents name the regulator.

Illustration only. A former client emails on 1 November complaining that the practice sent their tax return to the wrong address. The practice logs it the same day, acknowledges it on 3 November, investigates the breach, updates the client after two weeks and sends a written outcome with an apology and the steps taken. It treats the incident separately as a possible personal data breach.

The common mistakes are treating the Act as optional because most changes are permissive, ignoring complaints from people who are not clients, and relying on old ICO guidance that is still under review.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.