Significant Changes To UK Data Protection Legislation – Are You Still Compliant?

The Data (Use and Access) Act 2025 (the DUAA) officially became law in June 2025, with a phased enforcement model under which different provisions take effect at different times. On 5 February 2026, many more came into force, making key changes to the UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018 (the DPA).

This article looks at the key changes, and suggests actions that affected businesses should be considering now.

Key changes

One of the most significant changes relates to the transfer of personal data outside of the UK. Previously, whether personal data could be transferred outside of the UK depended on whether the transfer was deemed to be “adequate”. That might be because the jurisdiction in question had been given an adequacy determination (i.e. that the jurisdiction’s data protection practices were equivalent to those of the UK). Or on the basis that “appropriate safeguards” were in place, such as standard contractual clauses. There are