TL;DR: The Information Commissioner’s Office has confirmed that most remaining data protection provisions of the Data (Use and Access) Act (DUAA) came into force on 5 February 2026. The ICO gains new enforcement powers including the ability to compel witness attendance and issue fines of up to £17.5 million or 4% of global turnover.
What Has Changed
The latest phase of DUAA implementation brings the majority of outstanding data protection provisions into effect. Two notable exceptions remain: organisations will have until 19 June 2026 to implement a formal complaints procedure, and some ICO governance provisions will follow at a later date.
The ICO has published updated guidance on several fronts, including privacy by design and by default, subject access requests, and Part 3 codes of conduct for law enforcement bodies. Further consultations and guidance publications are planned.
New Enforcement Powers
The Act gives the ICO significantly expanded enforcement tools. The regulator can now compel witnesses to attend interviews, request technical reports from organisations under investigation, and impose fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR).
These powers bring the ICO’s enforcement capability closer to the scale of penalties available under the UK GDPR, and give the regulator sharper tools for investigating breaches of electronic communications rules covering areas such as marketing emails, cookies, and direct messaging.
Looking Forward
For businesses, the DUAA presents both obligations and opportunities. The ICO has framed the reforms as enabling organisations to “grow and innovate products and services whilst continuing to maintain good standards of protection.” In practice, companies handling personal data will need to review their compliance posture against the updated requirements, particularly around subject access requests and privacy by design. The June 2026 deadline for complaints procedures gives organisations a defined window to prepare.