UK reform overview. Consult the detailed current guidance for the particular activity.
What happened
The ICO’s guidance on the Data (Use and Access) Act 2025 explains changes to UK data-protection and electronic-communications rules. The changes were brought into force in stages. Its updated public guidance states that all stages were in force by 19 June 2026. Organisations should use current guidance rather than assume an older checklist remains complete.
Source: ICO — original source ↗
What it means for your website
If you operate a UK website, review policies and processes as well as the banner. The changes can affect how you handle complaints and access requests and how particular storage technologies are assessed. Do not translate this into a blanket claim that analytics no longer needs consent. Purpose, configuration and applicable conditions still matter. If you also serve EU customers, keep the UK and EU assessments distinct: a UK amendment does not rewrite every EU member state’s cookie rules. Choose a manageable review scope and record the guidance version behind each decision.
Three useful next steps
- Check the date and jurisdiction of your existing guidance.
- Review complaints and rights-handling procedures.
- Assess UK cookie exceptions against the actual configuration.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
ICO — original sourceICO — commencement updateOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.