ICO Plans for New and Updated Guidance — General Data Protection
The ICO's live tracker of all guidance being updated or created in response to the DUAA, including publication stages, consultation status, and expected publication dates through Summer 2026.
General data protection | ICO
Skip to main content
General data protection
Click to toggle details
Guidance stages explained
Drafting
– During this stage we pull together all relevant information and create a structured draft.
Public consultation/call for views (optional)
– Usually we carry out a public consultation or call for views before we complete the guidance. To understand more about how and when we do this, you can read our
consultation policy
.
Redrafting (following consultation) –
We make changes to the draft guidance to clarify issues and meet the needs of our audience.
Withdrawn –
Occasionally we decide to not proceed with a guidance project. If so, we’ll mark it as withdrawn and remove it when we next update this page. If we decide to revisit an issue, we add a new entry to this page.
Published –
Guidance is final and available on the website
Click to toggle details
List of guidance in development
Complaints guidance for organisations
Contracts and liabilities between controllers and processors update
Controllers and processors detailed guidance update
Data Protection Essentials
Data sharing for scams and frauds
Guidance on the Data (Use and Access) Act's new lawful basis of recognised legitimate interest
Handling subject access requests generated by AI
Lawful basis guidance update
Legitimate interest update
Personal data breaches guidance update
Personal Data Breach template
Privacy Notice Generator
The purpose limitation principle
Recognised legitimate interest
Recognised legitimate interest update to lawful basis interactive guidance tool
Recruitment and selection
Research, Archiving and Statistics Provisions update
Right of Access in brief update
Right to Object
Right to rectification
Right to restrict processing
SARs guidance for SMEs update
SARs Q&A
Special category data
Article 9 and Substantial public interest tools
New tools to support organisations in deciding about which special category data condition for processing may be appropriate.
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Summer 2026
Complaints guidance for organisations
Guidance for organisations on how to handle data protection complaints following the requirements introduced by the Data (Use and Access) Act.
StagePublished
Public consultation
: Yes (closed)
Final version of guidance
:
How to deal with data protection complaints
Contracts and liabilities between controllers and processors update
StageDrafting
Public consultation
: Yes (due to launch July 2026)
Final version of guidance due for publication
: Autumn 2026
Controllers and processors detailed guidance update
StageDrafting
Public consultation
: Yes (due to launch July 2026)
Final version of guidance due for publication
: Autumn 2026
Criminal offence data update
Update of existing guidance to cover Data (Use and Access) Act changes
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Summer 2026
Data Protection Essentials
StagePublished
Public consultation:
No
Private beta published
: 25 March 2026
Final version of guidance due for publication:
Summer 2026
Data sharing for scams and frauds
Update to advice to reflect new provisions in the DUA Act
Stage:
Drafting
Public consultation
: No
Final version of guidance due for publication
: Summer 2026
Exemptions guidance update
Update of existing guidance to cover Data (Use and Access) Act changes.
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Summer 2026
Handling subject access requests generated by AI
StageDrafting
Public consultation
: No
Final version of guidance due for publication
: Summer 2026
Lawful basis guidance update
Update of existing guidance to cover Data (Use and Access) Act changes
Stage:
Published
Public consultation:
No
Final version of guidance due for publication:
A guide to lawful basis
Legitimate interest update
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage:
Published
Public consultation:
No
Final version of guidance due for publication:
Legitimate interests (in brief)
,
Legitimate interests (in detail)
Personal data breaches guidance update
Update of existing guidance to cover Data (Use and Access) Act changes.
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Spring 2026
Personal data breach template
Template for organisations to log personal data breaches
Stage:
Published
Public consultation
: No
Final version of guidance
:
Personal data breach log template
Privacy Notice Generator
Update of existing guidance to include amendments from the Data (Use and Access) Act
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publicationSpring 2026
The purpose limitation principle
To include update to existing guidance and additional guidance.
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Winter 2025/2026
Recognised legitimate interest
Guidance for organisations on the new lawful basis introduced by the Data (Use and Access) Act
Stage:
Published
Public consultation:
Yes (closed)
Final version of guidance due
for publication:
Recognised legitimate interest (in brief)
,
Recognised legitimate interest (in detail)
Recruitment and Selection
Recruitment and selection guidance for organisations to include DUAA amendments
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publication
: Summer 2026
Research, Archiving and Statistics Provisions update
To include new amendments from the Data (Use and Access) Act.
Stage:
Public consultation/call for views
Public consultation:
Yes (open)
Final version of guidance due
for publication:
Summer
2026
Right of Access in brief update
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Spring
2026
The Right to object
Update of existing guidance to include amendments from the Data (Use and Access) Act
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publication
: Summer 2026
Right to rectification
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publication
: Spring 2026
Right to restrict processing
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publication
: Spring 2026
SARs guidance for SMEs update
Updates to four SAR products on advice for small organisations.
Stage:
Drafting
Public consultation:
No
Final version of guidance due for publication:
Spring 2026
SARs Q&A
Update of existing guidance to include amendments from the Data (Use and Access) Act.
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publication
: Summer 2026
Special category data
Update of existing guidance to provide minor clarifications and reflect legislative change.
Stage
: Drafting
Public consultation
: No
Final version of guidance due for publication
: Summer 2026
Back to top