IAPP UK Intensive 2026: Privacy | AI governance | Cybersecurity law

LONDON

23-26 February

Back to conference agenda

U.K. Data Reform in Focus: Does the DUA Act Go Far Enough

Wednesday, 25 Feb.

11:30 - 12:30 GMT

Intermediate level

BREAKOUT SESSIONPRIVACYLAW AND REGULATIONREGULATORY GUIDANCEENFORCEMENT

As the U.K. charts its own course in data protection and the Data (Use and Access) Act comes into force, this panel will unpack the key legal and operational changes introduced by the DUA Act – including updates to legitimate interests, automated decision-making, commercial research and the ICO’s new enforcement powers. The discussion will examine what these changes mean in practice for U.K.-based and cross-border businesses, including whether the reforms strike the right balance between flexibility and accountability. Panelists will also explore whether the U.K.’s approach offers useful lessons for the EU and whether Brussels should consider following the U.K.’s lead in adopting a more pragmatic, innovation-focused data protection model.

What you will learn:

  • The key legal and operational changes introduced by the U.K.’s Data (Use and Access) Act and what they mean in practice for U.K.-based and cross-border businesses.
  • Whether the U.K.’s reforms achieve the right balance between fostering innovation and maintaining accountability.
  • Whether the EU should adopt elements of the U.K.’s more pragmatic, innovation-oriented approach to data protection.

Moderator and speakers

headshot of Bojana Bellamy

Bojana Bellamy

CIPP/E

President

Centre for Information Policy Leadership

headshot of William Malcolm

William Malcolm

Executive Director of Regulatory Risk and Innovation

U.K. Information Commissioner's Office

headshot of Owen Rowland

Owen Rowland

Deputy Director, Head of Data Protection Policy

U.K. Department for Science, Information and Technology

generic profile silhouette

Sandra Wachter

Professor of Technology and Regulation

University of Oxford