The way businesses use data is an ever-evolving landscape and this year is shaping up to be a big year. Data compliance can be a big task for many business owners and managers – these latest developments are easy to miss. To assist you, this blog aims to signpost you to what is forecasted this year and what this means for you and your business.
UK data laws are evolving
The new Data (Use and Access) Act 2025, known as DUAA, will bring about changes impacting most businesses, with those changes being phased-in from 2025 into mid-2026. Revisions are likely to cause changes to purpose limitation, automated decision making and marketing (particularly for charities). There are also new ‘recognised’ legitimate interests, as well as minor refinements to data subject access requests processes and data complaints processes. The fines for non-compliance have also varied in some circumstances, becoming higher than they are at present.
Changes to the regulator
The Information Commissioner’s Office will become a new body named the Information Commissioner. This will not just be a change to name, but instead a change to the entire model and enforcement framework, with the new structure placing strong emphasis on holding businesses to account for poor practices.
The spread of AI
Artificial Intelligence tools are now widely available and widely used. Whether it is chatbots or recruitment tools, AI is changing how we work. But with this new dawn comes questions of fairness, transparency and privacy. New guidance is expected to assist businesses, and their people, with responsible AI use. We also recommend an AI Policy to help your workforce understand their duties and AI’s limitations.
Global Trends
If your businesses operate internationally, there is more to watch.
The EU is rolling out its AI Act – the first law of its kind globally – which hopes to provide a comprehensive legal framework on artificial intelligence.
We also are seeing several different approaches popping up in respect of children’s personal data usage. From Australia’s move to prohibit children under 16 accessing social media without verified parental consent, to numerous jurisdictions (including US) looking strongly at age verification or assurance measures.
In summary, 2026 is a year of opportunity for businesses that take data seriously as it is unlikely to become less of a priority any time soon. By acting now, you can build trust, avoid expensive and timely enforcement actions and claims and maintain market confidence.
Our Intellectual Property and Data Protection team can assist in providing clear concise advice on a wide range of issues surrounding data.