The DUAA Takes Effect: New ICO Powers Meet a Tougher Enforcement Stance
The Data (Use and Access) Act 2025 commenced on 5 February 2026, reforming automated decision-making, expanding ICO enforcement powers, and raising PECR fines to UK GDPR levels. Combined with record enforcement activity in 2025 and a new settlement procedure, the ICO is better equipped and more willing to act. What regulated businesses need to do now.