The British authority, the Information Commissioner's Office (ICO), reviews the first year of implementation of the Data Use and Access Act (DUAA) and details its new powers.

Since the law came into force on 19 June 2026, the ICO has prioritized publishing practical guidance to support organizations, focusing on thirteen high-impact areas such as data protection complaint handling and the right of access. Eleven consultations have been conducted on various topics including direct marketing, recognized legitimate interest, research, and automated decision-making, generating over 300 responses that have contributed to the development of new guidance.

The DUAA also grants the ICO new investigative powers, including the ability to compel a witness to a hearing and to request reports from accredited persons. The authority can now impose fines of up to £17,500,000 or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR). The ICO is finalizing procedural guidance on exercising these powers and plans to publish new updates during the summer, as well as to begin drafting a regulatory code of good practice on artificial intelligence.