News & implementation
Dated briefings connect official developments with the procedures and records you should review.
Most remaining data protection and privacy reforms commenced on 5 February 2026. Review lawful-basis, SAR, transfer and PECR procedures against the amended rules, rather than treating DUAA as a future proposal.
Read the briefingThe DUAA controller complaints requirements commenced on 19 June 2026. Facilitate complaints, acknowledge them within 30 days, make appropriate enquiries, keep the person informed and communicate the outcome without undue delay.
Read the briefingThe ICO finalised its storage and access technologies guidance on 29 April 2026. Limited statistical and appearance uses can qualify for an exception, with conditions including transparency and a simple free objection route.
Read the briefingThe Information Commission assumed the regulator’s functions on 30 September 2026. The organisation continues to use the ICO name as the Information Commission’s Office. Its core guidance, regulatory responsibilities and public services continue.
Read the briefingThe ICO’s updated electronic-mail guidance explains the charitable-purposes soft opt-in. Eligible charities must satisfy its own conditions; permission cannot be assumed merely because a message supports a good cause.
Read the briefingUse the RSS feed to follow new published briefings. Each article distinguishes its publication date from the underlying legal or guidance event.