After commencement: turn data protection reform into controlled change

Use the date for the provision

The Data (Use and Access) Act 2025 amended existing UK data protection legislation; it did not replace the UK GDPR, Data Protection Act 2018 or PECR. Its provisions did not all begin on Royal Assent. Commencement No. 6 brought specified measures into force on 5 February 2026, and section 103 and Schedule 10 on 19 June 2026.

The ICO updated its organisational overview on 19 June 2026 to reflect that the Act's data protection provisions were then in force. Individual guidance pages can still be under review. A summary saying only 'new law in 2025' therefore provides too little information for an implementation decision.

What a change owner should record

For each relevant measure, record the amended provision, commencement date, affected activity and any transitional rule. Decide whether the change requires an action, offers an option or has no material impact on the organisation. Support that conclusion with the official source and a named reviewer.

Map accepted changes to the actual workflow. A revised response procedure may require updated staff instructions, template wording, system fields and a worked example. Record the completion evidence and test the path staff will use. Do not close the item merely because a policy has a new date.

• Keep legislative text, official guidance and editorial interpretation separately identified.
• Retain the previous procedure where transitional treatment needs it.
• Record open interpretation questions and the advice needed to resolve them.
• Monitor the regulator's guidance updates after implementation.

Apply the method to other reforms

The same process helps with sector rules, contractual commitments and voluntary standards, provided their different legal status remains visible. This briefing illustrates a change-management method; it does not enumerate every DUAA amendment or determine what any particular organisation must do.