UK's Biggest Post-Brexit Data Shakeup Goes Live, Easing AI Rules

UK Activates Major Data Law Reform

The bulk of the UK's Data (Use and Access) Act 2025 officially came into force on 5 February 2026, representing the most sweeping reform of British data protection rules since Brexit. Brought in under Commencement No. 6, the new provisions reshape how organisations can process personal data, deploy automated decision-making systems, and interact with the country's data regulator.

A New Fast Lane for Data Processing

Among the headline changes is the introduction of "recognised legitimate interests," a new lawful basis under Article 6(1)(ea) of the UK GDPR. Unlike the existing legitimate interests route, this new category removes the requirement for organisations to perform a balancing test weighing their commercial needs against individual rights. The recognised interests include sharing data with public authorities, crime detection and prevention, national security, and safeguarding vulnerable individuals including children.

Automated Decisions Get the Green Light

The Act significantly loosens restrictions on automated decision-making. Previously, fully automated decisions with legal or significant effects on individuals required explicit consent. Under the new framework, organisations can rely on any lawful basis, provided safeguards are in place, including the right for affected people to contest decisions and obtain meaningful human intervention. AI companies operating solely in the UK stand to benefit most, though the use of special category data such as health or ethnicity remains restricted.

Regulator Gets Sharper Teeth

The Information Commissioner's Office now wields enhanced enforcement powers, including the ability to issue interview notices compelling individuals to attend and answer questions during investigations. The ICO can also require organisations to commission technical reports from approved experts at their own expense. Penalties for serious violations remain steep: up to seventeen point five million pounds or four percent of global annual turnover.

Children's Protections and Outstanding Provisions

The ICO has published updated guidance including new provisions on protecting children online, reinforcing the existing Age Appropriate Design Code. A requirement for organisations to implement formal complaints procedures will follow in June 2026, with further ICO governance changes expected later in the year.