The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 were introduced last week, bringing into force a number of the key provisions of the recently revamped data protection and privacy regime.

We have previously commented upon the passage and contents of the Data (Use and Access) Act 2025 here. It is a wide-ranging piece of legislation that seeks to modernise large areas of data protection and privacy law.

On 5 February 2026, the majority of the data protection and privacy provisions contained within Part 5 of the Act came into force. This includes the introduction of a new legal basis for processing personal data – known as ‘recognised legitimate interests’ – which allows processing for specified purposes (such as detecting, investigating or preventing crime and safeguarding vulnerable individuals) without the need for a legitimate interests assessment.

Also now in force are the new rules that relax restrictions on automated decision-making (ADM) and ease consent requirements for certain cookies.

In relation to ADM, other than in the context of processing special category data, its use to produce legal or similarly significant effects on individuals (so-called ‘significant decisions’) is permitted so long as appropriate safeguards are in place. These include: (1) providing the data subject with information about the decision reached; (2) enabling the data subject to make representations; (3) enabling the data subject to obtain human intervention on the part of the controller; and (4) enabling the data subject to contest the decision.

As for cookies, those that are used to collect information for statistical purposes to improve a website or service, or used in connection with website appearance, will no longer require consent.

Whilst many of the Act’s provisions are now in force, others will not take effect until later in the year, including the new regime for handling complaints (due to come into force on 19 June 2026) and changes to the ICO’s governance structures.

The Information Commissioner’s statement on the commencement of the Act, which includes links to various resources for organisations, can be found here.