New Laws UK 2026: Key Legal Changes Reshaping Britain

The Data (Use and Access) Act 2025

The DUA Act received Royal Assent on 19 June 2025 and has been commenced in phases through secondary legislation rather than all at once, which is why its effects have arrived piecemeal.

The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, made on 29 January 2026, brought key provisions into effect on 5 February 2026. These amend both the UK GDPR and the Privacy and Electronic Communications Regulations.

Three changes matter operationally:

• Enhanced ICO enforcement. The ICO can now issue GDPR-style fines of up to £17.5 million or 4% of global turnover under PECR, a substantial increase on the previous ceiling.
• Stronger investigatory powers. The ICO can compel a witness such as a manager or employee to attend interview, with giving a false statement in response being an offence, and can require production of specific documents including data protection impact assessments and transfer risk assessments through an information notice.
• Revised timeframes and exemptions. The tranche includes changes to data subject rights response timeframes, privacy notice exemptions, and children’s higher protection matters, alongside a reformulated adequacy test for international transfers.

The deadline still ahead is 19 June 2026, when the requirement to implement data protection complaint-handling processes takes effect.

The deepfake creation offence

This is the single most significant new criminal offence for practitioners to know about, and it is narrower and sharper than most summaries suggest.

Section 138 of the Data (Use and Access) Act 2025 was brought into force on 6 February 2026 by the Commencement No. 5 Regulations, made on 20 January 2026. It amends the Sexual Offences Act 2003 so that “intimate image” captures AI-generated and digitally manipulated content.

The offence is creating, or requesting the creation of, a purported intimate image of an adult without consent or reasonable belief in consent. Two features distinguish it from the existing framework:

• Creation, not just distribution. Previous offences targeted sharing. This targets production.
• The request alone suffices. An offence is committed even if the image is never produced or shared.

That second point is what practitioners most often get wrong. A person who commissions such an image has committed the offence at the point of asking, regardless of the outcome.

Online Safety Act enforcement

The Online Safety Act 2023 has moved from framework to enforcement, and the priority offence list has expanded.

On 8 January 2026 the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025 came into force, creating two new priority offences: making, encouraging or assisting serious self-harm, and cyber flashing. Both were already criminal offences; designating them as priority offences means regulated platforms must remove such content once aware of it and take steps to prevent it appearing.

Ofcom’s enforcement powers are substantial, with fines of up to 10% of global turnover available for failures in this area.

Further measures are in progress rather than in force. On 19 February 2026 the government announced an amendment to the Crime and Policing Bill requiring regulated service providers to take down non-consensual intimate images within 48 hours of notification. A separate amendment would bring AI chatbot providers not currently within the Online Safety Act’s scope into the regime, addressing the gap where a chatbot operating independently of a regulated social media service falls outside Ofcom’s powers entirely.

The Cyber Security and Resilience Bill

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament on 12 November 2025 and received its second reading on 6 January 2026. It is not yet law.

Its proposals include a strengthened enforcement regime with maximum penalties aligned to GDPR levels, and powers for the Secretary of State to instruct regulators and regulated organisations in emergencies.

For firms advising clients in regulated sectors, the practical question is scope: which organisations will fall within the regime and what incident reporting will be required. Those answers depend on the Bill’s final form and the secondary legislation that follows it.

Where AI regulation actually stands

This is the area where commentary most often outruns the law, so it is worth stating the position plainly.

The UK has not enacted a comprehensive AI statute equivalent to the EU AI Act. What exists is regulation of AI through existing regimes: data protection law governs AI systems processing personal data, the Online Safety Act governs AI-generated content on regulated platforms, and section 138 of the DUA Act criminalises a specific category of AI-generated imagery.

The unresolved questions remain unresolved. The use of copyright-protected material in AI training has been the subject of sustained consultation and dispute without a settled statutory answer. Obligations to label AI-generated content have been discussed rather than legislated.

For solicitors, the immediately binding constraints on AI use come from professional obligations rather than AI-specific statute. The duty not to mislead the court, the competence and supervision duties, and confidentiality all apply to AI-assisted work, as our guides to fake AI citations and AI in legal practice set out.

What this means for law firms

Three obligations land on firms directly rather than on their clients.

Data protection compliance needs revisiting. The February 2026 amendments changed response timeframes, privacy notice exemptions and international transfer assessment. A privacy notice last reviewed in 2024 is describing a different regime.

The June 2026 complaint-handling requirement is operational. It requires a process that works, not a policy that exists, and the ICO’s new power to demand specific documents means the evidence has to be producible.

Advising on the deepfake offence requires precision. Family, employment and criminal practitioners are most likely to encounter it, and the creation-and-request structure is materially different from the distribution offences that preceded it.

The wider justice-system reforms, including fixed recoverable costs, the ADR amendments and sentencing, are covered separately in our guide to Ministry of Justice reforms.