UK GDPR Guide (2026): DUAA Changes, Information Commission, Fines and Transfers

Who it applies to

• Organizations established in the UK that process personal information.
• Non-UK organizations that offer goods or services to people in the UK or monitor their behavior. They must appoint a UK representative unless they're a public authority or their processing is occasional, low-risk and doesn't involve large-scale special-category data (ICO transfers guidance).
• Most organizations, including sole traders, that use personal information must also pay a data protection fee under the Data Protection (Charges and Information) Regulations 2018, unless exempt (ICO fee).

Key requirements (baseline)

The UK GDPR has the same core architecture as the EU GDPR:

• the principles, with accountability
• six lawful bases
• transparency and data subject rights, with a one-month response time
• records of processing
• DPIAs for high-risk processing
• DPOs in defined cases
• processor contracts
• security of processing
• notifying the regulator of breaches within 72 hours where feasible
• restrictions on international transfers

See the AssureCore GDPR guide for article-level detail. The sections below focus on what's different in the UK in 2026.

What the DUAA changed

From the ICO's DUAA guidance:

New flexibility

• Recognised legitimate interests. For listed purposes, such as public security, you no longer have to carry out a balancing test.
• Automated decision-making. All lawful bases, potentially including legitimate interests, can now support significant automated decisions, provided safeguards are in place. This doesn't extend to special-category data.
• Cookies. Some cookies, such as those for statistics or improving site functionality, can be set without consent.
• Scientific research. Commercial research is clearly covered, "broad consent" to an area of research is allowed, and you don't have to give individual privacy notices where that would take disproportionate effort, as long as you publish one.
• Assumption of compatibility. Some reuses of data, such as archiving in the public interest, are treated as compatible with the original purpose.
• Subject access requests. You only need to make "reasonable and proportionate searches".
• Soft opt-in for charities, for email marketing.
• Clarifications. Direct marketing can be a legitimate interest, and the international transfer test has been reworded.

New requirements

• Children. Online services likely to be used by children must take their needs into account. Following the Age Appropriate Design Code should already meet this.
• Complaints.
• Help people complain, for example with an electronic complaints form.
• Acknowledge complaints within 30 days.
• Respond "without undue delay".

Regulator changes

• The ICO can now compel witnesses to attend interviews, using interview notices, and can request reports from approved persons. It has published draft enforcement procedural guidance.
• The ICO was a corporation sole. On 30 September 2026 it became the Information Commission, a body corporate with executive and non-executive members. Its "role, responsibilities, or powers" are unchanged (GOV.UK).

International transfers

• EEA → UK. The European Commission renewed both UK adequacy decisions (GDPR and the Law Enforcement Directive) on 19 December 2025. They run until 27 December 2031 and now cover all personal information, including immigration-related data that was previously excluded (ICO).
• UK → elsewhere. Use UK adequacy regulations (these cover all EEA countries), the International Data Transfer Agreement, or the UK Addendum to EU SCCs, together with a transfer risk assessment. UK BCR Addenda are available for groups that already have EU BCRs.

Penalties

Under DPA 2018 s157, the higher maximum is £17,500,000 or 4% of total annual worldwide turnover, whichever is higher. It applies, among other things, to failures to comply with information, assessment, interview or enforcement notices. The standard maximum is £8,700,000 or 2%. For infringements of the UK GDPR itself, the maximum is the amount specified in UK GDPR Article 83 (DPA s157). Penalty notices are issued under s155, which now also covers failing to comply with an interview notice (DPA s155).

Certification

There's no mandatory certification. UK GDPR certification schemes and codes of conduct are voluntary. Cyber Essentials and ISO/IEC 27001 are commonly used to evidence security of processing.

Mapping to related frameworks

• EU GDPR: the same baseline. UK-only differences are the DUAA flexibilities, the complaints duty and the transfer tools.
• PECR: governs cookies and electronic marketing, also amended by the DUAA.
• Cyber Essentials and ISO/IEC 27001: evidence of Article 32 security.
• UK AI regulation: the ICO's automated decision-making guidance links data protection to AI governance.

Readiness checklist

1. Confirm that you've paid the data protection fee, or that you're exempt.
2. Refresh your records of processing and your lawful basis register. Decide where recognised legitimate interests now apply.
3. Review automated decision-making and document the safeguards: information, the right to make representations, and human intervention.
4. Reclassify cookies against the new exemptions and update banners.
5. Publish a complaints route, track the 30-day acknowledgement, and log outcomes.
6. Update your SAR procedure to reflect "reasonable and proportionate" searches.
7. Assess children's needs for any online service likely to be used by children.
8. Check that your transfer mechanisms (adequacy, IDTA or Addendum) and TRAs are current.
9. Appoint a UK representative if you're based outside the UK and in scope.
10. Update privacy notices and staff training, and replace references to the "Information Commissioner" with the "Information Commission" where you mean the regulator.

Common pitfalls

• Assuming the DUAA removes UK GDPR obligations. It amends them; it doesn't remove them.
• Missing the new complaints-handling duty.
• Applying cookie exemptions too broadly. Advertising cookies still need consent.
• Relying on legitimate interests for automated decisions involving special-category data.
• Forgetting the UK representative requirement.

How AssureCore helps

AssureCore's Policy Management, with AI-assisted writing and gap analysis, helps you update privacy policies for the DUAA. The Risk Register and action plans track remediation, Evidence Management (with expiry alerts) keeps transfer agreements and records current, and Cross-framework Mapping shares controls with the EU GDPR.

Frequently asked questions

Official references

• ICO – The Data (Use and Access) Act 2025: what does it mean for organisations?
• GOV.UK – Information Commission succeeds the ICO (30 Sep 2026)
• Data Protection Act 2018, section 157 – Maximum amount of penalty
• Data Protection Act 2018, section 155 – Penalty notices
• ICO – Receiving personal information from the EEA
• ICO – Data protection fee

Related frameworks

• GDPR guide
• CCPA guide
• LGPD guide
• NIST Privacy guide