IAPP UK Intensive 2026: Privacy | AI governance | Cybersecurity law
LONDON
23-26 February
U.K. Data Reform in Focus: Does the DUA Act Go Far Enough
Wednesday, 25 Feb.
11:30 - 12:30 GMT
Intermediate level
As the U.K. charts its own course in data protection and the Data (Use and Access) Act comes into force, this panel will unpack the key legal and operational changes introduced by the DUA Act – including updates to legitimate interests, automated decision-making, commercial research and the ICO’s new enforcement powers. The discussion will examine what these changes mean in practice for U.K.-based and cross-border businesses, including whether the reforms strike the right balance between flexibility and accountability. Panelists will also explore whether the U.K.’s approach offers useful lessons for the EU and whether Brussels should consider following the U.K.’s lead in adopting a more pragmatic, innovation-focused data protection model.
What you will learn:
- The key legal and operational changes introduced by the U.K.’s Data (Use and Access) Act and what they mean in practice for U.K.-based and cross-border businesses.
- Whether the U.K.’s reforms achieve the right balance between fostering innovation and maintaining accountability.
- Whether the EU should adopt elements of the U.K.’s more pragmatic, innovation-oriented approach to data protection.
Moderator and speakers

Bojana Bellamy
CIPP/E
President
Centre for Information Policy Leadership

William Malcolm
Executive Director of Regulatory Risk and Innovation
U.K. Information Commissioner's Office

Owen Rowland
Deputy Director, Head of Data Protection Policy
U.K. Department for Science, Information and Technology

Sandra Wachter
Professor of Technology and Regulation
University of Oxford