DUAA Decoded: New ICO powers, PECR reform and e-privacy rules in the UK

Episode 3: The ICO is being restructured, and its enforcement powers are being expanded. And PECR — the rules governing direct marketing, cookies and electronic communications — is being significantly updated. For organisations already navigating a complex data protection compliance landscape, the changes introduced by the Data (Use and Access) Act 2025 have real operational implications.   What has changed? What does it mean for how organisations handle cookies, direct marketing and data breaches? And what should compliance teams be prioritising now?  Senior knowledge lawyer Emma Keeling and former ICO Deputy Commissioner Steve Wood close this three-part series by examining the DUAA's enforcement and e-privacy provisions, covering the ICO's restructured governance, its expanded enforcement powers, and the PECR updates that affect direct marketing and cookie compliance. The alignment between PECR and the broader data protection regime is a key focus.  This podcast provides a practical understanding of the DUAA's enforcement architecture and what the changes to PECR mean for compliance programmes.  DUAA Decoded examines the practical implications of the UK's Data (Use and Access) Act 2025. Each episode unpacks what has changed and, crucially, what it means for organisations operating under the UK's data protection framework. These podcasts provide a clear, practical understanding of the DUAA's innovation-focused provisions, and what they mean for day-to-day data operations.