ICO highlights its new powers 12 months on from DUAA receiving royal assent
On 23 June 2026, the Information Commissioner’s Office (ICO) published a blog looking back on the 12 months since the Data Use and Access Act 2025 (DUAA) received Royal Assent. The blog talked about the support and guidance the ICO has provided during that time to help organisations with the DUAA changes and there was an important reminder about the ICO’s new powers.
The ICO’s new powers
The ICO’s new powers include the ability for the ICO to:
1. Compel a witness (e.g. an employee or former employee of a controller or processor) to attend an ICO interview and answer questions, where the ICO suspects that there has been a breach of the UK General Data Protection Regulation (UK GDPR) or the Data Protection Act 2018 (DPA 2018). There is protection for individuals in that an interview notice will not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence. This does not extend to an offence under the DPA 2018, but in that situation, a statement made by an individual in response to an interview notice may not be used in evidence against that individual in a prosecution for an offence under the DPA unless certain limited circumstances apply.
2. Require organisations (both controllers and processors) to make arrangements and pay for an approved person to prepare a report about a specified matter relating to an investigation, for example the baseline facts of a data breach.
3. Require organisations to provide documents as well as information.
4. Issue fines of up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations 2003 (PECR), bringing PECR fines in line with those under the UK GDPR.
Is the ICO using its new powers?
The ICO says it wants to provide organisations with more detail about how it will use its new investigation and enforcement powers by publishing guidance before they begin using them. However, they also caution that the new powers are in effect so they can and will use them where necessary for the most serious cases.
What guidance is available?
To assist organisations, the ICO has produced enforcement procedural guidance setting out the process it will follow when using its powers, carrying out investigations, taking enforcement action and exercising some of its other duties. At the moment this guidance is still only in draft form although the consultation closed at the end of January 2026.
When finalised, the draft guidance will, alongside the 2024 ICO Data Protection Fining Guidance, constitute updated statutory guidance about regulatory action replacing existing statutory guidance set out in the current 2018 ICO Regulatory Action Policy. Information about the ICO’s criminal powers is set out in a separate 2018 ICO prosecution policy statement.
As DUAA largely aligns the PECR and UK GDPR investigatory and enforcement powers, the ICO says it proposes to take the same approach to both but is considering whether separate guidance is needed although the ICO has confirmed it will produce and publish separate fining guidance for PECR.
Key takeaway
Whilst ICO investigations and enforcement action may be more likely, what remains key is how organisations respond to contact from the ICO. Seeking legal advice and engaging proactively with the ICO at the earliest opportunity can often lead to a more favourable outcome.
______________________________________________________________________
Disclaimer
This information is intended for general informational purposes only and does not constitute legal advice. We recommend seeking professional advice before taking any action on the information provided. If you would like to discuss your specific circumstances, please feel free to contact us on 0800 2800 421.
