ICO updates on plans for supporting economic growth as key parts of the DUA Act come into force

This time last year, the ICO published a letter to the UK government setting out five new initiatives to support innovation and sustain economic growth (which we discuss in our blog). The ICO has now published its follow-up letter, providing an update on progress since. With the main data protection changes from the Data (Use and Access) Act 2025 (DUA Act) having come into force yesterday and arguably heralding a new pro-growth era for UK data protection, we outline below the key takeaways from this latest ICO letter.

Regulatory certainty on AI for businesses

The ICO is now actively working on a statutory code of practice on AI and automated decision-making (ADM), whereas it was merely in contemplation last year. Exact timings are still unclear, although the ICO explains it has “worked closely with government on scope and timelines for the required secondary legislation to enable the rules to become a statutory code of practice”. 
Separately, the ICO is also making updates to its existing ADM and profiling guidance to reflect the DUA Act changes. The ICO had promised to launch a consultation on these updates by the end of 2025, but this has now slipped until ‘Winter 2025/2026’. Given the pace of AI development, particularly around agentic AI (see the ICO’s report and this blog), refreshed guidance should provide organisations with the certainty they need to innovate, and hopefully will now follow soon. 

Cutting costs for SMEs

The ICO will deliver the expanded data essentials training and assurance platform it promised in 2025 by Spring 2026, to help SMEs use personal data with confidence. The need to support SMEs navigate compliance burdens without unnecessary risk aversion has also been recognised at EU level, with the European Data Protection Board publishing its Helsinki statement in July 2025.  

Enabling more innovation through the ICO Regulatory Sandbox and Innovation Advice services

In 2025, the ICO suggested implementing an experimentation regime within their regulatory sandbox. This would allow businesses to have a time-limited derogation from specific regulatory requirements to test new ideas. The ICO has now committed to implementing this and has secured the funding from the Regulatory Innovation Office (RIO) for feasibility and design work. This is a positive development but one which still seems to require a number of steps, including the publication of reports on the potential economic impact and levels of demand for the service, a citizens' jury looking into the public's views and expectations, an alignment with the government's AI Growth Lab proposals and, crucially, legislative change to allow for real-world testing of emerging technologies. 

Unlocking privacy-preserving online advertising 

The ICO is still looking to support a shift to privacy-preserving forms of online advertising. In July 2025, the ICO launched a consultation on its enforcement approach to online advertising, to inform which low-risk advertising activities wouldn’t be prioritised for enforcement (where carried out without user consent). The ICO letter confirms that it will be reporting to the Government on these low-risk activities this spring, with a view to the Government adding them, via regulations, to the list of consent exceptions in PECR. There is no further mention of the ICO’s amended enforcement approach, which raises the question as to whether this project has been superseded by plans to change the law instead.  

Making it quicker and easier to transfer data internationally

The ICO published its updated guidance on international transfers last month and as we discuss in our blog, the guidance is more detailed than previously and, overall, presents a pragmatic approach which businesses will find helpful. 

Looking ahead

The ICO will continue with its plan to produce guidance on the DUA Act changes. In addition, the ICO commits to: 

• produce new guidance on purpose limitation, codes of conduct and data protection by design;
• increase transparency and predictability through updated procedural guidance on its regulatory and enforcement approach, following its October 2025 public consultation; and
• collaborate with other Digital Regulation Cooperation Forum members to develop a prototype digital library covering regulatory requirements across the digital landscape.

The ICO will also become a corporate body, which may bring a greater range of perspectives on its governing board. That, and other factors, may influence the exact way the ICO delivers on its plans, but the direction of travel and sustained commitment to supporting innovation and growth are clear.