Is UK GDPR still relevant to businesses in 2026?

Last updated: 26 September 2026

Yes. UK GDPR and the Data Protection Act 2018 still apply to every UK organisation that handles personal data, whatever its size. The rules have been updated by the Data (Use and Access) Act 2025, but the core duties have not gone away: collect only the data you need, keep it secure, be transparent with people, and be able to show how you comply.

What changed with the Data (Use and Access) Act 2025?

• February 2026: most of the Act’s changes to UK GDPR, the Data Protection Act and PECR (the rules on marketing emails and cookies) came into force. These include clearer “recognised legitimate interests”, more flexibility for some automated decisions, and higher PECR fines, now in line with UK GDPR.
• 19 June 2026: organisations must have a process for handling data protection complaints from individuals.
• From 30 September 2026: the Information Commissioner’s Office is replaced by a new Information Commission, which continues to regulate and enforce data protection.

Why UK GDPR still matters for your business

• Fines and enforcement: serious breaches can lead to fines of up to £17.5 million or 4% of global turnover.
• Customer and supplier trust: clients, insurers and larger organisations increasingly ask for evidence of good data handling before they work with you.
• Cyber security: UK GDPR requires “appropriate technical and organisational measures”, so weak passwords, missing updates or no MFA can become a compliance issue as well as a security risk.
• Breach reporting: most personal data breaches must still be reported to the regulator within 72 hours.

How ABCOM can help

We help businesses and charities across Sussex put the technical side of data protection in place, including Microsoft 365 security, MFA, device management, backups and Cyber Essentials. See also how to ensure GDPR compliance, or contact our team.

This article is general guidance, not legal advice.