20/05/2026
UK data law just changed.
Most charities don’t know it yet.
In June 2025, the Data (Use and Access) Act 2025, the DUAA — received Royal Assent.
By February 2026, its most significant provisions came into force.
This is the biggest reform to UK data protection law since GDPR arrived in 2018.
And yet, in the charity and faith sector, I’m still having conversations where leaders haven’t heard of it.
That changes this week.
Over the next 7 days, I’ll be breaking down exactly what the DUAA means for charities, faith organisations, and social enterprises — in plain English, no jargon.
Here’s your overview of the 4 changes that matter most to your organisation right now:
1. The Charitable Purpose Soft Opt-In (in force: 5 February 2026)
For the first time, charities can send emails and texts to supporters who’ve already shown interest in your work without needing their explicit consent first.
This could transform how you communicate with donors and volunteers. But strict conditions apply, and it doesn’t cover your existing database automatically.
2. A New Statutory Duty to Handle Data Complaints (deadline: 19 June 2026)
Every UK charity — regardless of size must have a formal, documented data protection complaints procedure in place by 19 June 2026. That’s less than 30 days away. There are no exemptions.
3. Updated Cookie Rules for Your Website
Some low-risk cookies such as those used for analytics or improving website functionality, may no longer require user consent under the DUAA.
If your charity has a website (and almost every charity does), this affects your cookie banner and privacy notice.
4. Changes to Automated Decision-Making.
If your organisation uses any AI tools, algorithms, or automated systems to process beneficiary or supporter data, the rules around how you do that and how you inform people have been updated.
Why does this matter so much?
Because the ICO is no longer issuing soft warnings.
In 2025, total ICO fines reached £21.7 million. The regulator has made clear it is moving toward significant financial penalties for organisations that fail to keep pace with the law and the third sector is not exempt.
The good news: the DUAA isn’t designed to punish charities. Many of these changes actually give you more flexibility and new tools to engage your community.
But you have to know what they are first.
This week, I’m sharing useful information you need to know.
Follow along. Share this with a trustee, operations lead, or charity manager who needs to see it.
And if you’re thinking: “We definitely haven’t looked at any of this” — stay close. This week is for you.
More details on Information Commissioner's Office page.
