The 2026 Data Protection Pivot: Navigating the New British Consensus

Subject access requests: what actually changed

Two changes, and both codify practice the ICO already endorsed rather than creating new rights.

Stop the clock. Sections 75 to 77 of the DUA Act allow a controller to pause the response period where it reasonably needs further information from the requester to confirm the scope of the request, for example where it holds a large volume of personal data about them. The clock restarts when the clarification arrives. The previous framework allowed a fixed extension but no pause.

Reasonable and proportionate searches. Section 78 confirms that a controller need only carry out reasonable and proportionate searches, and it came into force on Royal Assent rather than in the February tranche.

The practitioner view is worth noting alongside the headline. Because both provisions largely reflect existing ICO guidance, several firms have assessed the practical impact as limited. What they change is the evidential position: a controller relying on stop-the-clock now points to statute rather than to guidance, which matters in a contested DSAR.

Privilege and DSARs

This is the most practitioner-relevant point in the whole subject, and general data protection commentary rarely covers it.

The Data Protection Act 2018 provides an exemption from the subject access right for information in respect of which a claim to legal professional privilege could be maintained in legal proceedings. For a law firm responding to a DSAR, that exemption is doing a great deal of work.

Three points follow in practice. The exemption attaches to the material rather than to the firm, so it has to be assessed document by document rather than applied wholesale. It covers what would be privileged in proceedings, which is narrower than everything on a client file. And where a DSAR arrives from a former client, the analysis frequently turns on whether privilege belongs to them in the first place.

The DUA Act does not alter this. What it changes is the surrounding mechanics, which means a firm with a solid privilege assessment now also has a statutory basis for seeking clarification before conducting the exercise.

Recognised legitimate interests

A new lawful basis at Article 6(1)(ea), in force from 5 February 2026, covering a closed list of public interest purposes including national security and public security, emergencies, the detection and prevention of crime, safeguarding vulnerable individuals, and democratic engagement.

Where processing falls within the list, the balancing test required for ordinary legitimate interests does not apply. That is the whole benefit, and it is narrower than it first appears.

Two limits matter. The list is closed, so a purpose that merely resembles one on it does not qualify, and ordinary legitimate interests with a documented assessment remains the route. And recognised legitimate interests is explicitly unavailable as a lawful basis for significant automated decisions, which is a trap for anyone assuming the new basis simplifies AI-driven processing.

For most firms the practical effect is limited. The purposes on the list are public-interest activities rather than ordinary commercial processing, and existing legitimate interests assessments remain necessary for almost everything a firm does.

Automated decision-making

This is where genuine divergence from the EU position has occurred.

Previously, solely automated decisions with legal or similarly significant effects could only be made on a narrow set of lawful bases. The DUA Act opens this to the full range, including legitimate interests, provided appropriate safeguards are in place. Special category data remains more protected and cannot be processed this way under the expanded rules.

Employment practitioners should note the consequence: it is now materially easier to use automated decision-making in internal processes in the UK than in the EU. For firms advising employers operating on both sides, that divergence has to be managed rather than assumed away.

The safeguards are the condition of the liberalisation. Human oversight needs to be real and documented, not asserted, and a firm auditing a client’s automated systems should be looking for evidence that a human can and does alter outcomes.

The June 2026 complaints requirement

From 19 June 2026 organisations must have a process enabling data subjects to complain directly, with a 30-day acknowledgement requirement.

This is an operational obligation rather than a policy statement, and it is the deadline most firms have not built for. What it requires in practice:

• A published complaints procedure that a data subject can find and use
• A named owner responsible for handling complaints
• A complaints log, maintained separately from subject access request tracking
• Acknowledgement within 30 days, and substantive response without undue delay
• Response templates prepared in advance rather than drafted under pressure

The policy intention is to divert complaints from the ICO by requiring controllers to address them first. The practical consequence for firms is a second complaints channel operating alongside the existing client complaints process required by the SRA, and the two need to be distinguishable to staff receiving them.

Transfers and the Data Protection Test

The terminology changed and the substance moved slightly.

The “Data Protection Test” replaces the language of adequacy decisions, with approved countries designated by regulation, and the terminology of transfer risk or impact assessments has been revised alongside it. The test asks whether protection in the destination is not materially lower than under the UK regime, which is a different formulation from the EU’s essentially equivalent standard.

The practical question for firms is not whether this jeopardises adequacy, since that was renewed in December 2025 to 2031. It is whether a firm’s transfer documentation uses current terminology and reflects the current test. Assessments drafted before February 2026 use language the regime no longer employs.

Where a firm handles EEA-linked data, maintaining the stricter standard remains prudent. The EDPB’s October 2025 opinions supported renewal while flagging monitoring concerns, so the position is settled for now rather than settled permanently.

Firms as controllers

Most coverage of this subject addresses solicitors advising clients. Firms are themselves controllers of unusually sensitive material, and the obligations land on them directly.

Alongside the DSAR and complaints requirements above, the February 2026 tranche strengthened the ICO’s investigatory powers. It can now compel a witness such as a manager or employee to attend an interview, with giving a false statement being an offence, and can require production of specific documents including data protection impact assessments through an information notice.

That changes what a privacy programme has to be. A firm asked to produce a specific DPIA has either done it or has not, and the ability to point to a policy is no longer the answer. Breach notification obligations are covered separately in our guide to cybersecurity duties for solicitors, and the wider digital law changes in our guide to what changed in 2026.

The ICO has said it is taking a proportionate and supportive approach as the new provisions come into force, which is an opportunity to get documentation in order rather than a reason to defer it.