Data (Use and Access) Act Part 5 to Commence on 5 February 2026

For DMA members, this marks the formal commencement of a package of reforms that have been under development since the Bill’s introduction. These changes affect the operation of the UK’s data protection framework and are directly relevant to data-driven marketing, advertising and related services.

The government has also confirmed that the Part 5 measures requiring controllers to establish new statutory complaints-handling processes for data subjects will not commence at this stage. These provisions are expected to be brought into force approximately 12 months after Royal Assent.

As commencement approaches, attention is turning to guidance from the Information Commissioner’s Office. While the ICO has published an outline plan for new and updated guidance, progress has been slower than the DMA would expect given the scale and significance of the legislative changes now taking effect.

Of particular concern is the fact that most of the guidance areas most relevant to DMA members will not be subject to consultation. This includes guidance on lawful basis and legitimate interests, alongside other updates arising from Part 5 DUAA.

The result is a growing gap between legislative change and regulatory interpretation, with organisations left awaiting clarity on how amended provisions will be applied in practice.

This is especially significant in relation to lawful basis and legitimate interests, including how amendments to Article 6(1)(f) will be reflected in guidance.

During the passage of DUAA, the DMA played a leading role in securing a clear improvement to the legitimate interests framework. That change was designed to provide greater certainty and flexibility for responsible data use, reflecting the realities of modern, accountable marketing and innovation.

Ensuring that the ICO’s guidance accurately reflects both the intent of Parliament and the legitimate interests changes achieved through the legislative process is now critical. Misalignment between statute and guidance would risk undermining the clarity that DUAA was intended to deliver.

The DMA has consistently argued that high standards of data protection and responsible innovation are mutually reinforcing. Legal certainty and regulatory clarity are essential for investment, planning and growth in data-led marketing.

The DMA will continue to engage closely with government and the regulator as Part 5 is commenced and guidance is developed, and will keep members informed as further detail becomes available.

For guidance on the use of legitimate interest, the DMA's new Data Protection for Marketers Guide is now available, offering extensive expert information and advice on data protection legislation.