Get Ready for 2026… Data Management
As part of our December “Get Ready for 2026” Programme, our third focus area is data management.
In June 2025, the Data Use and Access Act 2025 (DUAA) was introduced, phasing amendments to data legislation between June 2025 and June 2026.
The DUAA amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR).
It’s expected that some key changes will be introduced in January 2026, although no firm dates have yet been provided.
We’ve set out the changes likely to affect the VCSE sector below:
From early 2026 (possibly January)
-
The Data Use and Access Act (DUAA) 2025 amends the Privacy and Electronic Communications Regulations (PECR), allowing charities to send direct marketing about their charitable purposes without consent.
This charitable purpose soft opt-in can only be used if specific conditions are fully met. These are:
You’re a charity – as defined under the law in England, Scotland or Northern Ireland.
The sole purpose of your direct marketing is to further one or more of your charitable purposes.
You obtained the contact details directly from the recipient.
You obtained the details in the course of the recipient either expressing an interest in one or more of your charitable purposes or offering or providing support to further one or more of your charitable purposes.
You gave an opportunity to refuse or opt out when you collected the details.
You give an opportunity to refuse or opt out in every subsequent communication.
You’ll still need to have a laeful basis for processing, and you’ll need to update your privacy notices if you choose to use this mechanism.
-
The concept of ‘recognised legitimate interests’ is to be introduced, whereby organisations will not be required to conduct a balancing test (i.e. Legitimate Interests Assessment) when relying on this lawful basis – but only for specific, recognised purposes. The list of recognised legitimate interests includes the following:
■ Disclosures to public bodies, where it is asserted personal data is necessary to fulfil a public function.
■ Disclosures for national or public security or defence purposes, emergencies.
■ Disclosures for prevention or detection of a crime, and safeguarding vulnerable individuals. -
The DUAA will include extending the exceptions to consent from only ‘strictly necessary’ to include other specific types of ‘low risk’ cookies and similar technologies. The exemption will be permitted for certain statistical purposes and optimising website appearance, as long as clear information is provided and users are given a straight-forward ability to opt-out.
-
The DUAA introduces a statutory requirement for all organisations to implement a formal data protection complaints process by June 2026.
The regime imposes two core duties:
Creating and publicising a complaints process
Operating that process effectively in practice
The ICO’s draft guidance expands on these requirements and stresses that organisations must:
Make the complaints process easy to locate (e.g. linked prominently from privacy notices and websites);
Explain clearly how complaints will be handled, including timeframes; and
Ensure the process is available to all individuals, not only customers or employees.
Facilitate the making of complaints, including by providing an electronic complaint form and alternative routes (e.g. email and post).
The ICO also states organisations should provide multiple channels (such as online forms, email, or postal options) and could offer dedicated contact points or FAQs to guide complainants. The emphasis is on accessibility and clarity, avoiding unnecessary procedural hurdles.
What should I do now?
There’s a lot still to be confirmed and it’s important that organisations stay abreast of the changes as they’re announced. You can sign up for the ICO (Information Commissioner’s Office) newsletter here: https://ico.msgfocus.com/k/Ico/sign_up_form_january_2022
Schedule reviews of your Privacy Notices, Data Protection and Cookies policies for early 2026.
Review your ROPA (Record of Processing Activities) for data gathered under the “legitimate interest” lawful basis, and consider whether this will now meet the criteria for “Recognised Legitimtate Interests”
Arrange staff training on the changes. You can check our training programme here: Events | Join Gloucestershire VCSE Sector Events Today — Gloucestershire VCSE Alliance
Further information and training
The DPO Centre offers free, on-demand webinars focussing on key updates: Privacy Puzzle On Demand Sign Up - Outsourced Data Protection Officers GDPR and Data Protection Compliance
Keep an eye on our News Bulletin for updates and training around the changes Our Mailings | Stay Informed — Join Today — Gloucestershire VCSE Alliance
Our next instalment will look at Local Government Reorganisation (LGR) in 2026.