What changed
Most remaining data protection and privacy reforms commenced on 5 February 2026. Review lawful-basis, SAR, transfer and PECR procedures against the amended rules, rather than treating DUAA as a future proposal.
Action for your organisation
Keep a change log recording the legal provision, commencement date, procedure affected, owner and implementation evidence. Apply transitional provisions where requests or conduct pre-date commencement.
Start with your procedure inventory
Identify the documents and software rules that still refer to six lawful bases or describe DUAA as a future reform. Record which provisions actually affect your processing and whether a transitional rule applies.
Map the change to evidence
Review the lawful-basis register, rights workflow, international-transfer decisions and cookie inventory. Assign an implementation owner, record the decision and sample-test the revised procedure.
Keep the legal dates separate
Most core reforms took effect on 5 February 2026. The controller complaints procedure began on 19 June 2026. The reasonable-and-proportionate SAR search amendment has its own commencement and retrospective provision; do not assume every change started on the same day.
Put it into practice
Use the relevant topic guide to review the legal conditions, then capture the decision in the working registers. Assign an owner and review the implemented process, not just the wording of the policy.
Official sources
Original explanatory briefing prepared with AI-assisted source comparison. No independent human legal review or regulatory endorsement is claimed.