UK businesses facing phased rollout of data protection law changes
UK businesses will face a six- to nine-month implementation window for the Data (Use and Access) Act 2025 (DUAA), with the first changes expected by mid-December 2025 and most major guidance set for release in winter 2025/2026, the Information Commissioner’s Office says. While no fixed dates have been issued, the regulator's timeline signals a gradual rollout. Key updates will address lawful bases, complaint handling, research provisions and consent requirements for low-risk advertising.