The first substantive amendments to UK GDPR since the UK inherited it arrived this year, in two instalments. Most of them reduce work. That is precisely why nobody read them.
Regulatory change usually arrives with a sense of threat, which is what gets it read. The Data (Use and Access) Act 2025 arrived with the opposite, and has been largely ignored as a result.
It became law on 19 June 2025 and makes the first real amendments to UK GDPR since the UK inherited it. The Act itself sets no dates — commencement is left to the Secretary of State by regulations — and the provisions have landed in stages. The Commencement No. 6 Regulations brought the bulk of the data protection reforms into force on 5 February 2026, and the new complaints duty followed on 19 June 2026.
The headline for a mid-market business is that this is mostly good news. It codifies scattered guidance, adds clarity where there was genuine ambiguity, and removes red tape. But “mostly good news” is not “no action”, and two changes deserve deliberate attention rather than passive relief.
The change that widens what you may automate
The most consequential amendment is section 80, which replaces Article 22 of the UK GDPR with new Articles 22A to 22D. It came into force in February.
Previously, significant decisions made solely by automated means sat inside a narrow set of permitted routes. Now that narrow gate applies principally where special category data is involved. Where it is not, significant automated decisions are permitted more broadly — provided safeguards are in place: notice to the individual, and genuine rights to contest the decision, make representations, and obtain human intervention.
Read carelessly, that sounds like permission to automate freely. It is not. It moves the obligation from may you do this at all to can you evidence the safeguards — a different question, and in some respects a harder one, because safeguards have to work rather than merely exist.
The test has moved from whether you are allowed to automate a decision to whether the person affected can genuinely contest it and reach a human. That is a design requirement, not a policy paragraph.
This matters more than it first appears, because significant automated decisions are not confined to anything exotic. Credit and payment-terms decisions. Automated screening in recruitment. Pricing driven by rules engines. Fraud scoring that declines a transaction. Much of that was built years ago, runs quietly, and has never been assessed against a safeguards test — because until February the question was framed differently.
The duty that landed in June
Section 103 inserts a new section 164A into the Data Protection Act 2018, and it came into force on 19 June 2026 — four months after the rest. If you read a summary written in February, this one was probably described as forthcoming.
It gives data subjects a right to complain directly to the controller where they consider there has been an infringement. The corresponding duties are specific rather than general:
- Provide a complaint form that can be completed electronically and by other means
- Acknowledge receipt within 30 days of the complaint arriving
- Take appropriate steps to respond, make enquiries where appropriate, and inform the complainant of the outcome
A related provision allows the Secretary of State to require controllers to report complaint numbers to the Commissioner, so the volume may not stay private indefinitely.
The operational problem is routing. These complaints will arrive by whatever channel the individual has to hand — a support inbox, a sales contact, a web form built for something else. If nobody has decided in advance where they go, they will be answered as ordinary customer service enquiries by people with no idea they are handling a regulatory matter with a 30-day clock attached.
The changes that genuinely reduce work
Set against those, several February amendments make life easier and are worth claiming rather than ignoring.
Recognised legitimate interests. Section 70 adds a new lawful basis at Article 6(1)(ea) for processing necessary for a recognised legitimate interest, with the qualifying purposes set out in a new Annex. These include responding to requests from public bodies, and processing connected with security, safeguarding, emergencies and crime prevention. For those purposes the balancing exercise legitimate interests normally demands is no longer required in the same form. Organisations that wrote careful assessments for straightforward safeguarding disclosures have less to do.
Cookies. Section 112 replaces regulation 6 of the PEC Regulations, and Schedule 12 inserts a new Schedule A1 listing exceptions to the consent requirement. Two are directly useful: storage whose sole purpose is collecting information for statistical purposes about how a service is used with a view to making improvements, and storage whose sole purpose is adapting the appearance or functionality of a service to the user’s preferences.
That second one is where a careless reading gets expensive. These are exceptions to consent, not to transparency. Both still require that users are given clear and comprehensive information and a simple means of objecting, free of charge. The model is opt-out, not silence. Removing your banner entirely on the strength of this would be a mistake.
One structural change worth knowing about
Part 6 of the Act replaces the Information Commissioner — an individual office holder — with an Information Commission, a body corporate with a board. It changes little day to day for a mid-market business, but it is the regulator you correspond with, and the name on the guidance will change.
What to actually check this quarter
- List every decision made about a person without a human in the loop — credit terms, screening, pricing, fraud declines. For each: is special category data involved, and can the person genuinely contest it and reach a human?
- Decide where a direct complaint goes, who owns it, and how the 30-day acknowledgement is tracked. Then tell the teams who will receive one first.
- Publish a complaint form that works electronically and by another route. This is an explicit requirement, not an inference.
- Revisit the cookie banner against the statistical and functionality exemptions — you may be seeking consent you no longer need. Keep the information and the free, simple objection route.
- Review legitimate interests assessments for safeguarding and public-body disclosures. Some of that work is now redundant.
- Note which provisions are still to be commenced during 2026, and who is watching for them.
Why this gets missed
Deregulatory change has no natural owner. A new obligation generates a project because somebody is accountable for the risk. A relaxation generates nothing, because nobody is accountable for failing to take advantage of one.
The result is asymmetric. Organisations carry the strictest reading of the old rules forward indefinitely, and simultaneously miss the amendments inside the package that do require action — in this case an automated decision-making change that moves the compliance question for systems already in production, and a complaints duty with a hard deadline that arrived four months after most of the commentary was written.
The work is not large. It is an afternoon with a list of automated decisions and an honest answer about whether a person could actually contest one, plus a decision about where complaints land. What makes it worth scheduling is that the answer is discoverable now, by you, rather than later, by someone who has complained and is counting the days.