What is to come?
It has been reasonably well publicised that, following the Data (Use and Access) Act 2025 (DUAA) receiving Royal Assent on 19 June 2025, the Government and the ICO (soon to be the Information Commission) have advised that changes to GDPR, the Data Protection Act and the Privacy and Electronic Communications Regulations 2003 will start to be phased in. At the time of writing, there have been no published changes, with the ICO still advising on its website that changes will be published as they are released. However, guidance can be found here:
https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance
When giving Royal Assent, the Government advised that the changes would take effect in August and be phased in over the next twelve months. Guidance on the planned stages, including those already in effect, can be found here:
https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement
A summary of the main changes that will affect law firms is shown below, but of particular interest is the ICO’s intention to formally introduce an exemption for “legal professional privilege”, which will make it clear that Law Firms are not compelled to release confidential communications between them and their clients under a Data Subject Access Request (DSAR). This will be welcome news to law firms as the number of DSARs has increased exponentially in recent times.
Other changes that we can expect to be phased in are summarised as follows.
- Consent rules for low-risk cookies are relaxed (e.g. for analytics, site optimisation and emergency assistance cookies) – explicit consent will no longer be required.
- Fines increased under PECR to £17.5 million or 4% of annual global turnover.
- Timing for DSAR responses, including stop the clock provisions and Data Controllers must only carry out ‘reasonable and proportionate’ searches.
- ‘Further Processing’ as a new basis for lawful processing.
- ‘Recognised legitimate interests’ will no longer require a balance test.
- Firms will be allowed 30 days to address a complaint before the ICO will become involved in a complaint relating to a data breach.
- New rules for automated decision-making systems.
There are other changes listed, but these are unlikely to have an impact on law firms.
It is the ICO’s guidance to:
- Review the proposals, as they are not likely to change.
- Review your Cookie Policy to align with the new proposals.
- Review and ensure you have a written procedure for handling:
- Complaints relating to data
- DSAR’s
- Review if you have any automated decision-making systems (profiling) and review the proposed rules.
- Update staff training.
- Consider new technology and how this may impact on data management.
The ICO has launched a series of public consultations to help shape final guidance on the amendments to provide organisations with more confidence in handling personal information:
Conduct a GDPR Audit
For some Firms, if they have not performed a GDPR Audit, they may consider that the time is right to do so. Our UK GDPR and Data Protection Audit will provide the firm’s management with the confidence of knowing that it is compliant with the requirements of the regulation and can demonstrate such compliance. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these.
The following key areas will be considered as part of the audit:
- All policies to ensure they are up to date with the latest regulations and legislation.
- Data Retention approach and management
- System security
- Data storage processes
- Internal
- External arrangements
- Data management control
- Data Portability
- Cyber Crime Protection and Awareness
- Remote working management
- Terms and Conditions
- Data Controller/Processor arrangements and agreements
- Contracts
- Customer Notices
- Internal systems and controls
- Staff Notices
- Reporting
- Breach Management
- Breach Storage
- Subject Access Request Management
- ICO Reports and Engagement
A full report will be issued to the firm, which will be followed up with a discussion of any recommendations and actions that are made. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these. For detailed information on this service and costings, download our brochure.
For RACO Member Firms that are using the Regulation and Compliance Office’s services, we will ensure your policies, controls and procedures are updated as the ICO starts to implement the changes that impact on law firms. If you are a Firm that does not utilise our Risk and Compliance Services, you can find more information below.
Our Compliance Services
At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:
- Regulation & Compliance Service – Our Regulation and Compliance Service, Inc. Risk Management Assessment and AML Risk, provides a cost-effective but essential solution for law firms to ensure they achieve a compliant environment. We work with firms of all types, from sole practitioners through to partnerships, Limited Companies and ABSs. We recognise that it is essential to recognise how a firm implements compliance to tailor the solution to each firm’s working practices. This is why our service is completely bespoke to each firm we work with.
- Regulation & Compliance Outsource Guidance and Support Service – This service provides law firms with a cost-effective outsourced solution which sees the compliance managers of RACO take on the day-to-day guidance and support expected to be provided by COLPs, COFAs, Data Compliance Officers, MLROs and MLCOs. This addition to the Regulation and Compliance Service, including Risk Management and AML Risk, relieves Compliance Officers of most of the day-to-day burden of keeping up with regulatory requirements and ensures staff have access to compliance and risk advice when needed.
Contact Us
To ask any questions about the Regulation & Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
