UK data protection law changed more between June 2025 and September 2026 than at any time since Brexit, and many security and privacy programmes are still working from the old rulebook. The UK GDPR and the Data Protection Act 2018 (DPA 2018) remain the core of the regime, but the Data (Use and Access) Act 2025 (DUAA) has amended both, raised PECR fines to UK GDPR levels, changed the rules on automated decisions and cookies, added a complaints duty, and turned the Information Commissioner's Office into the Information Commission. This guide explains who and what the regime covers, the obligations that matter most to security teams, the current status of the reforms as of October 2026, how enforcement works, and what it means for AI agents and machine identities that process personal data. It is for security leaders, privacy engineers and DPOs. For the EU regime it shadows, see the GDPR Compliance Guide for Security Teams.
Key takeaways
- Three instruments, read together. The UK GDPR sets the core rules, the DPA 2018 fills in exemptions, conditions and enforcement, and the DUAA 2025 amends both. PECR sits alongside for cookies, electronic marketing and telecoms breaches.
- The reforms are now in force. The ICO states that all data protection provisions of the DUAA had commenced by June 2026, and the ICO became the Information Commission on 30 September 2026. Existing references to the ICO stay legally valid.
- 72 hours is still the breach clock. Notifiable personal data breaches go to the regulator without undue delay and not later than 72 hours after becoming aware, and PECR breaches now follow the same 72-hour deadline instead of 24 hours.
- Fines are tiered and PECR has caught up. The higher maximum is £17.5 million or 4% of worldwide annual turnover, the standard maximum £8.7 million or 2%, and PECR penalties have risen from £500,000 to the UK GDPR levels.
- Security failures drive the big penalties. The £14 million Capita fine turned on unfixed privileged access weaknesses and a 58-hour alert response, which are identity and detection problems, not paperwork problems.
Scope: who and what is covered
The UK GDPR applies to the processing of personal data by controllers and processors established in the UK, and to organisations outside the UK that offer goods or services to, or monitor the behaviour of, individuals in the UK. Personal data includes online identifiers such as device IDs and cookie identifiers when they can be linked to a person, and pseudonymised data is still personal data.
| Instrument | What it does | Parts that matter to security teams |
|---|---|---|
| UK GDPR (retained Regulation (EU) 2016/679, as amended) | Principles, lawful bases, rights, controller and processor duties, transfers | Art. 5 principles, Art. 25 data protection by design, Art. 28 processors, Art. 30 records, Art. 32 security, Arts. 33 and 34 breaches, Art. 35 DPIAs, Arts. 22A to 22D automated decisions |
| Data Protection Act 2018 | Supplements the UK GDPR (Part 2), separate regimes for law enforcement (Part 3) and intelligence services (Part 4), the regulator (Part 5) and enforcement (Part 6) | Schedule 1 conditions and the appropriate policy document, s.157 penalty maximums, s.164A complaints, s.170 unlawful obtaining, s.171 re-identification offence, s.146 assessment notices |
| Data (Use and Access) Act 2025 | Amends the UK GDPR, DPA 2018 and PECR; also covers smart data schemes, digital verification services and the Information Commission | Part 5 data protection and privacy changes, Part 6 Information Commission, new ICO investigatory powers |
| Privacy and Electronic Communications Regulations 2003 (PECR) | Cookies and similar technologies, electronic marketing, telecoms security and breaches | Cookie consent and the new exemptions, 72-hour breach reporting for service providers, UK GDPR-level fines |
- Controllers and processors: Controllers decide why and how data is processed; processors act on instructions under an Art. 28 contract.
- Special category and criminal offence data: Health, biometric (where used for identification), genetic, racial or ethnic origin, political, religious, union, sex life and sexual orientation data need an Art. 9 condition, and many of those conditions require a Schedule 1 DPA 2018 condition plus an appropriate policy document.
- Law enforcement and intelligence: Law enforcement processing by competent authorities follows DPA 2018 Part 3, and intelligence services Part 4.
- Relationship with the EU: The EU GDPR still applies directly to UK organisations that target or monitor people in the EU. The European Commission has renewed its UK adequacy decisions until 27 December 2031, so EU to UK transfers need no extra tools.
Key obligations
The seven principles in Art. 5 drive everything else: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability, meaning the controller must be able to demonstrate compliance. The table below lists the obligations security teams most often own or evidence.
| Obligation | Source | What good evidence looks like |
|---|---|---|
| Appropriate technical and organisational security | UK GDPR Art. 32 | Risk assessment, encryption at rest and in transit, access control with least privilege, backup and restore tests, regular vulnerability scanning and penetration testing with tracked remediation |
| Data protection by design and default | Art. 25 | Design reviews, default-off data collection, retention set at build time |
| Records of processing | Art. 30 | A maintained register that maps processing to systems, data stores, processors and retention |
| Processor contracts and assurance | Art. 28 | Contracts with Art. 28(3) terms, security due diligence, audit or report rights, sub-processor approval |
| DPIA for high-risk processing | Art. 35 | Completed DPIA before launch for profiling, large-scale special category data, systematic monitoring and novel technology |
| Breach notification and records | Arts. 33 and 34 | Incident runbook with a 72-hour clock, breach log covering every breach, decision records for breaches not reported |
| Rights requests | Arts. 12 to 22 | Identity verification, search procedures that are reasonable and proportionate, one-month response tracking |
| Complaints handling | DPA 2018 s.164A (added by DUAA) | An accessible way to complain, such as an electronic form, acknowledgement within 30 days and a response without undue delay |
| International transfers | UK GDPR Chapter V | Transfer register, UK adequacy regulations or the International Data Transfer Agreement or UK Addendum, transfer risk assessments |
What the ICO expects for Art. 32
- Encryption: The ICO recommends encryption for personal data that is stored or transmitted over the internet.
- Baseline controls: It describes Cyber Essentials as a good starting point that may need to be exceeded for higher-risk processing, and points to NCSC guidance, including the 10 Steps to Cyber Security.
- Resilience: Systems must be resilient and access to personal data restored in a timely manner after an incident.
- Testing: Art. 32(1)(d) requires a process for regularly testing and evaluating the effectiveness of measures, with results documented and acted on.
Breach reporting in practice
A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Under Art. 33, the controller must notify the regulator without undue delay and not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to individuals. Information can be provided in phases, and late notifications must explain the delay. Where the risk to individuals is high, Art. 34 requires telling them without undue delay in clear language, with practical advice such as resetting passwords. Log every breach, reported or not. For a cross-jurisdiction runbook, use the Data Breach Notification Checklist.
Timeline and current status
The DUAA received Royal Assent on 19 June 2025 and was commenced in stages by regulations. As of October 2026, the ICO states that all of its data protection provisions are in force, although the ICO's enforcement procedural guidance on its new powers was still in draft at its last update.
| Date | Change | Status in October 2026 |
|---|---|---|
| 25 May 2018 | DPA 2018 and GDPR apply in the UK | In force |
| 31 December 2020 | UK GDPR created from retained EU GDPR at the end of the transition period; penalty sums set in pounds | In force |
| 19 June 2025 | DUAA Royal Assent; some provisions, including parts of the new automated decision-making rules for specified purposes, start | In force |
| 20 August 2025 | Commencement No. 1: smart data powers and the PECR breach notification change (s.111) | In force |
| 1 December 2025 | Commencement No. 4: most of the digital verification services framework | In force |
| 5 February 2026 | Main data protection amendments, including Arts. 22A to 22D on automated decisions for all remaining purposes | In force |
| 19 June 2026 | Complaints duty (DPA 2018 s.164A) and its penalty provision (s.157(4A)); ICO states all data protection provisions are now in force | In force |
| 30 September 2026 | The Information Commission replaces the Information Commissioner (SI 2026/1015); UK GDPR references change from "Commissioner" to "Commission" | In force |
What the DUAA changed
- Recognised legitimate interests: A new lawful basis for listed purposes, such as public security and safeguarding, where no balancing test is needed.
- Automated decision-making: Arts. 22A to 22D replace Art. 22. A decision is solely automated where there is no meaningful human involvement, and significant if it has a legal or similarly significant effect. Organisations may now rely on any lawful basis, including legitimate interests, for significant automated decisions if safeguards are in place, but not for special category data.
- Subject access: Controllers need only make reasonable and proportionate searches when responding to a request. See the DSAR Guide: Handling Data Subject Requests.
- Cookies: Some non-essential cookies, such as those for statistics, site appearance or performance, and emergency assistance, can be set without consent, subject to conditions. EU cookie rules have not relaxed, so dual-regime sites must still meet both.
- Transfers: The test for international transfers has been reworded. The ICO says this does not materially change how organisations can transfer personal data.
- Regulator powers: The regulator can compel witnesses to attend interviews and require reports from approved persons, and PECR enforcement is aligned with UK GDPR enforcement.
Enforcement and penalties
Penalty maximums sit in s.157 DPA 2018 and Art. 83 UK GDPR. The regulator also uses information notices, assessment notices (audits), enforcement notices requiring specific action, reprimands, and, for some offences, prosecution.
| Tier | Maximum for undertakings | Typical infringements |
|---|---|---|
| Higher maximum | £17.5 million or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher | Principles, lawful basis, rights, international transfers, failure to comply with an enforcement notice or certain information, assessment and interview notices |
| Standard maximum | £8.7 million or 2%, whichever is higher | Controller and processor duties such as Art. 32 security, Art. 33 notification, records and DPIAs; complaints duty under s.164A |
| PECR (post-DUAA) | Up to £17.5 million or 4% of annual global turnover (previously £500,000) | Unlawful cookies, unsolicited marketing, telecoms breach failures |
| Criminal offences | Prosecution under DPA 2018 | s.170 unlawful obtaining or disclosure, s.171 re-identification of de-identified data, s.173 altering records to prevent disclosure to a data subject |
What recent cases show
- Capita (October 2025): The ICO fined Capita plc £8 million and Capita Pension Solutions £6 million, £14 million in total, down from a proposed £45 million, after a March 2023 attack affected about 6.6 million people. The ICO found no tiering model for administrative accounts, a weakness flagged at least three times, a 58-hour response to a high-priority alert raised within 10 minutes against a one-hour target, and penetration testing only when systems were first commissioned.
- 23andMe (June 2025): The ICO fined 23andMe £2.31 million after credential stuffing exposed genetic data, with findings that included the absence of mandatory multi-factor authentication. See the 23andMe Breach 2023 analysis.
What it means for AI agents and non-human identities
Service accounts, API keys, OAuth tokens, workload identities and AI agents are where personal data is actually read, copied and moved at scale. The UK GDPR does not mention them, but several obligations land on them directly.
- Security of processing: An over-privileged service account with a long-lived key is an Art. 32 weakness. The Capita findings on administrative tiering apply just as much to machine accounts with domain or cloud admin rights. See the Secrets Management Guide.
- Records and accountability: Your Art. 30 record should show which agents, integrations and service identities touch each processing activity, and who owns them. An agent with access to a CRM is a processing activity, not just a tool.
- Automated decisions: An AI agent that approves, rejects or prices something with legal or similarly significant effect, without meaningful human involvement, falls under Arts. 22A to 22D. Rubber-stamping agent output is unlikely to be meaningful involvement. See the AI and GDPR Guide.
- Breaches: A leaked token that grants access to personal data is a potential personal data breach from the moment you become aware of it. Token revocation and access log review must fit inside the 72-hour window.
- Governance: Treat each agent as an identity with an owner, a purpose and scoped permissions that match the lawful basis. See the Identity Governance for AI Agents Guide.
Compliance steps
- Confirm your regime map. List which entities are controllers or processors in the UK, which also fall under the EU GDPR, and whether any processing is Part 3 law enforcement processing. Update privacy notices and contracts for the DUAA changes; references to the ICO can be updated over time.
- Refresh the record of processing. Map each processing activity to systems, data stores, human and non-human identities with access, processors and retention. Use this to scope the rest of the work.
- Re-test Art. 32 controls against the enforcement pattern. Prioritise privileged access tiering for human and machine admin accounts, MFA on internet-facing access, alert triage targets that are measured and met, and penetration testing beyond go-live with findings shared across business units.
- Rehearse the 72-hour clock. Run a tabletop that starts with a leaked token or a ransomware alert and ends with a draft Art. 33 notification. Include the processor hand-off.
- Review automated decisions. Inventory models and agents that make significant decisions, document the lawful basis and the Art. 22C safeguards (information, the ability to make representations, human intervention and contest), and run a DPIA. See the DPIA Guide: Running a Data Protection Impact Assessment.
- Stand up the complaints process. Provide an electronic complaint route, acknowledge within 30 days and log outcomes.
- Re-baseline cookies and marketing. Apply the UK cookie exemptions only to UK users and keep EU consent where EU users are in scope; PECR fines now match UK GDPR fines.
- Roll back safely. Where a change such as relaxing cookie consent or switching an automated decision to legitimate interests is challenged, keep the previous configuration and documentation so you can revert quickly.
Small and large organisations
A small organisation can usually meet the regime with a single record of processing, Cyber Essentials as a baseline, a one-page breach runbook and a named contact. A large group needs a DPO where Art. 37 applies, formal processor assurance, a measured security operations function, and joined-up governance across entities, because, as Capita showed, regulators will look at how findings travel between business units.
Measuring it
- Breach notification time: Hours from awareness to Art. 33 notification, target well under 72.
- High-priority alert response: Median time to triage against your documented target.
- Privileged identity coverage: Percentage of human and machine admin accounts in a tiered model with MFA or short-lived credentials.
- Record of processing freshness: Percentage of processing activities reviewed in the last 12 months, including the identities with access.
- Rights and complaints performance: Percentage of access requests answered within one month and complaints acknowledged within 30 days.
Common failure patterns
- Known weaknesses left open: A penetration test finding about admin tiering or flat networks raised repeatedly and never fixed becomes the centre of the penalty notice.
- Alerts without response: An understaffed SOC misses its own triage targets for months.
- Optional MFA: Leaving MFA opt-in on customer accounts invites credential stuffing, as the 23andMe Breach 2023 showed.
- Help desk resets that bypass identity checks: Social engineering of staff password resets led to the Co-op Cyber Attack 2025, which exposed data on 6.5 million members.
- Waiting for certainty: Holding notification for the forensic report instead of notifying in phases inside 72 hours.
Framework mapping
| UK requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Know your legal obligations | GV.OC-03 | PT-2, PT-3 | A.5.31, A.5.34 |
| Records of processing (Art. 30) | ID.AM-07 | PM-5, SI-12 | A.5.9, A.5.12 |
| Security of processing (Art. 32) | PR.DS-01, PR.AA-05 | SC-28, AC-6, CP-9 | A.8.24, A.8.2, A.8.13 |
| Monitoring and response | DE.CM-03 | AU-2, IR-8 | A.8.15, A.8.16 |
| Breach notification (Arts. 33 and 34) | RS.CO-02, RS.CO-03 | IR-6 | A.5.24, A.5.26 |
| Processors (Art. 28) | GV.SC-05 | SA-9, SR-6 | A.5.19, A.5.20 |
| DPIA (Art. 35) | GV.OC-03 | RA-8 | A.5.34 |
Practitioner checklist
- Confirm which entities and processing fall under the UK GDPR, the EU GDPR, DPA 2018 Part 3 and PECR.
- Update notices, contracts and procedures for the DUAA changes and the Information Commission name.
- Map every processing activity to the human and non-human identities with access and their owners.
- Put human and machine admin accounts into a tiered model with MFA or short-lived credentials.
- Measure alert response against a documented target and fix staffing gaps that miss it.
- Rehearse a 72-hour breach notification, including phased reporting and processor hand-offs.
- Inventory automated decisions and agents with significant effects and document Art. 22C safeguards.
- Launch a complaints route with 30-day acknowledgement and track outcomes.
- Re-baseline cookies and marketing for UK and EU users separately.
Standards and references
- legislation.gov.uk: UK GDPR Article 33, Notification of a personal data breach
- legislation.gov.uk: Data Protection Act 2018
- legislation.gov.uk: Data (Use and Access) Act 2025
- legislation.gov.uk: UK GDPR Article 22A, Automated processing and significant decisions
- ICO: The Data (Use and Access) Act 2025, what does it mean for organisations?
- ICO: Personal data breaches, a guide
- ICO: A guide to data security
- ICO: Capita fined £14m for data breach affecting over 6m people
Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · AI and GDPR Guide · Data Breach Notification Checklist · UK Cyber Security and Resilience Bill Guide · Global Privacy Regulatory Map. This guide summarises the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 as of October 2026 and is not legal advice.